Exchange - Net Admin - Outlook
Windows Mobile - Windows

Contact - Director's Blog

Exchange Server Home

Exchange Consultancy

Exchange Resources

Microsoft Exchange
Amazon Store

Basic Email Gateway Server

Company wide Contact List

Disabled User Account

Distribution Lists

DNS Configuration

Exchange and a
Dynamic IP Address

Event ID 1221

Filter Unknown Users

Global Mailbox Folder
Permissions from Server

Intelligent Message Filter

Internal Email Address
for External People

Mailbox and Management
Account

Message Tracking

Migrating to a new server

Multiple Domains

Offline Address Book Errors

Options when a Staff Member
Leaves

Outlook Web Access

PDAs, OMA and EAS

Permissions Best Practises

Post Install Configuration

Public Folders

Prerequisites for Exchange
System Tools

RPC over HTTPS

Secure your SMTP Relay

Shutdown Script

SMTP Services and Exchange

SMTP Diagnostics

Spam Cleanup

Switching From POP3
to SMTP Delivery

Telnet Test

Username Change

Exchange Server Compatibility Information Exchange Server Version Compatibility 5.5* No 2000 Yes 2003 Yes 2007 Yes * May Adapt (More Information)

Public Folder Permissions
Author: Simon Butler, Exchange MVP, MCSE

Public Folders Section Home Page

One of the reasons that public folders are so popular is because of the control you have over them with permissions. You can actually hide public folders from users totally, so that they don't even know that they are there.

To get the best from public folders though, there are some things that you need to consider.

Highest Permission Setting Wins

If a user is a member of a group and that group is given one set of permissions, you cannot lock the user out by restricting their access as a named individual.
Similarly, if the Default permission is set too high, then that give unforeseen access (see below).

Review the "Default" Permissions

The "Default" permission is what a user gets when they are aren't controlled by another permission to their user or group.
Therefore it can give a user unintentional access to a folder.
To combat that, change the "Default" permission to none for all of your public folders.

If you have a folder that everyone in the company needs to see and possibly review the contents of, then use your equivalent of "All Staff" to set the basic permission.

Anonymous Permission and Mail Enabled Folders

If the folder is mail enabled, then the anonymous permission needs at least contributor rights to be able to receive email. Contributor can email the folder, but cannot see it or modify the contents.

This permission can catch people out when they have a mail enabled folder which they want to use internally but hide from the users. The anonymous permission does not apply to a user with Outlook on the same server. They are not anonymous, but are an authenticated user.
Therefore if you want internal users to be able to email a public folder, then they need at contributor rights.
Use your equivalent of "All Staff" to grant that permission to everyone, then increase the permissions as required for the people who need to access it.

Use Groups and not Individuals Where Possible

This is quite obvious really. Using a group is always better than setting permissions to individuals. Particularly when you are setting the owner right to someone in the IT team.
For Owner type permissions, create a group called "Email Admins" and then grant this group owner of all of your public folders. Should someone in IT then leave, they can be removed from the group without having to worry about permissions on the individual folders. It also helps if you need to delegate access to someone without giving them access to their entire Exchange system.

Owner Rights

In many cases users don't need owner rights. This can give them more permissions than they need. It may also lead to someone deleting a folder in error, particularly if they are a non-technical user. Modify the permissions so that the user has just the rights that they need, without giving them too many. If your number of public folders is quite small, then it no trouble for the administrator to have to make some changes to the public folders which the users cannot.

Permission Propagation

Public Folder permissions only propagate automatically when the sub folder is first created. Therefore if you are going to be creating a significant hierarchy of public folders, create the parent folder first and set the permissions that you want to propagate down to the new folders. Once you are happy with the permissions, then create the new folders.
If you need to add someone or a group later on, then use the tools in ESM to propagate the settings. Exchange 2003 SP2 is the best tool for this as you can add someone or a group and propagate down without overwriting the existing permissions. There is no equivalent in Exchange 2007.