No announcement yet.

Unable to restrict Calendar access in Exchange 2003

  • Filter
  • Time
  • Show
Clear All
new posts

  • Unable to restrict Calendar access in Exchange 2003

    Platform: Exchange 2003 running on Server 2003 Standard SP2, A/D domain environment (Exchange server is not the domain controller)

    The problem: I have not been able to restrict access to calendars, in searching the internet and the Exchange forums here I found just the opposite, problems accessing calendars. I have gone to the extreme of removing Default and anonymous permissions on local machine but I am still able to access a calendar that I need only a few clients to access. I tried using PFDavAdmin to adjust permissions but I receive the same results. It has occurred to me that a GPO is controlling the permissions behavior however I am not sure where that policy would be. Also if it helps under the Administration tab for calendar properties for all options is "greyed out (I have attached a screen capture for the administration tab) I am unable to remove the "default" under the Permissions tab in Calendar Properties.

    Many Thanks,


  • #2
    Re: Unable to restrict Calendar access in Exchange 2003

    Sorry, no screenshot visible here.

    It depends on how you give people access to the calendar, if you give them FullMailboxAccess in Exchange Advanced Properties, it means full acces for the whole mailbox including the Calendar which cannot be restricted.

    But there is a second option you can give permission on the toplevel of the mailbox (for instant read permission) and then different permission on the Calendar.


    • #3
      Re: Unable to restrict Calendar access in Exchange 2003

      The usual reason for this is that the permissions are set at the server level and involve full mailbox access. I would verify if people can open other mailboxes and folders. If they can then there is a more serious problem.

      You should put the anonymous and default permissions back in - they shouldn't have been removed. They are set to none by default.

      When it comes to checking permissions, remember two things.
      1. Permission changes are not live. It can be two hours before the permissions take effect.
      2. Most of the permissions you see in ADUC are the object - the AD account, not the content - the mailbox.

      The only permissions that will give access are Full Mailbox Access and the combination of Send As/Receive As. No other permissions should be touched.
      When it comes to changing permissions - NEVER remove anything from the top box (where accounts/groups are listed) unless you are 100% sure you know of the consequences. I have seen people remove Everyone for example and then wonder why Exchange is dead two hours later.

      What has probably happened is that one of the two sets of permissions above has been grated to a group, which users are a member of. Administrators, Domain Admins, something like that.

      Be very careful with Exchange permissions.

      Simon Butler
      Exchange MVP

      More Exchange Content:
      Exchange Resources List:
      In the UK? Hire me:

      Sembee is a registered trademark, used here with permission.