Outlook Profile Issue (View others emails)

[Steve Bowman]

I have a workstation that contains 6 outlook mail profiles. When Outlook starts it asked for the profile you want then prompts for the selected profile mailbox. Once the profile is selected then it will ask for the credentials, if you select cancel the mailbox will still open and you can view all emails previously sent/received. You cannot send/receive any new mail without supplying the mailbox password BUT you can VIEW all their previous emails. To a degree, this is a security issue as it does allow access to mailbox emails without permission to do so. Is there any way to automatically close outlook if no credentials are entered?

Steve Bowman
Independent Technology, Inc.
CA, USA

 

[kjv1611]

The mailboxes (pst files) are separate from the mail accounts. Sure you can have IMAP, etc, but what's on the PC is local content, same as if you downloaded files from OneDrive and saved to a local folder. That's where the security is different. Unless the PST itself were password protected, it's just a file siting in a Windows directory.

For instance, you could create multiple mailboxes yourself on your local PC, regardless of what email account you use, and drag/drop items into it out of other boxes tied to accounts. then later, you could still open those PST files without your login credentials.

I guess it's assumed that if you're downloading the PSTs to your computer, then why wouldn't you later have the same access? You'd have to login with Windows to get access to the files anyway, so the same or similar security would be at the OS level. and if the PST files are on your PC, then you had permission in the past, one way or another.

Another example: you are migrating from one email service to another. You want to keep the old mailbox, but have no right to keep old account login credentials. The mail stored in your PST is your mail, whether you continue to pay for the subscription service further or not. So you keep the PST file (mailbox file) and delete the account from Outlook.

Basically you have to remember: the mailbox file and the account are 2 separate entities. If you want or need more control, then you have to think about other ways of doing so.

"But thanks be to God, which giveth us the victory through our Lord Jesus Christ." 1 Corinthians 15:57

 

[Steve Bowman]

I have a full understanding of the mechanics of files and local security access to them. What I am not understanding is if I am not providing proper credentials of the outlook profile why it would open the outlook profile anyway. That is my issue since they are just local files (actually OST not PST) residing on the workstation and since Outlook will open the profile without credentials I am by default giving the user access to email data that they should not have access to. Since I have not provided credentials for the profile should'nt Outlook just close.

Steve Bowman
Independent Technology, Inc.
CA, USA

 

[strongm]

Outlook is pretty much working as it is supposed to here, I am afraid. As Microsoft have stated "profiles are not intended to secure Outlook accounts from other users". One way to protect against this is to disable Cached Mode - but that can have performance implications.