users can access all mailboxes in OWA

[miatamonkey]

When a user opens his mailbox through OWA (

http://server/exchange/username),

he can open any other mailbox he likes by simply replacing the username in the URL.
He must enter username / password the first time he connects, but once he's in, he can open any mailbox without having to enter the other users' password.
Basically anyone can see anyone's mailbox.
The users are no administrators and I did not mess with the permissions (I think ). This is exchange 2K on win2K.
Anybody have an idea how I can resolve this?

 

[Haleon]

The first thing I'd do is check the permissions on the database. Open up System Manager, locate the mailbox store, right click on it, and click security. Make sure the Everyone group doesn't have permissions on it.

 

[fdevocht]

the everyone group has no permissions, only (domain)admins and domain servers etc.

 

[Haleon]

Try checking the security of individual mailnbox rights. Open up Active Directory Users and Computers, turn on the Advanced Features, right click a user account, go to properties, then go to the Exchange Advanced tab. Click on the Mailbox Security button and see what rights are listed there.