One for other IT Support Techies

[Keith Peppiatt]

OK... we've just hit a wee issue with Outlook 2003 since enabling cached mode for our new global roll out.

pc is logged on as a generic account lets call it "engineers"

Outlook has a profile for each engineer, Adam, Bob, Charlie, Dave, etc ... (etc must have been really hated by his parents! ;) )

Adam is the default mail account.

Charlie comes upto PC and gets prompted to choose profile when starting outlook. He forgets to choose his name and click ok, thus selecting Adam. User credentials get presented and Charlie realises his mistake and clicks cancel.

Adams cache is loaded and Charlie can do whatever he wants in here, read, compose, edit etc...

Anyone know of anyway to prevent this from being displayed? I've got a call in with MS but still awaiting a call back so though bounce out here in case you've seen this before and have a solution.

Thanks in advance.

[Ricky Willox]

Do the right thing give the engineers thier own account , generic account are bad security wise.

Other than that dunno ill take a look at what happens if I do the same here. But that might not help using outlook 2007. Ill post results.

Seriously though I would consider seperate account's.

Ok just tried the same setup here and got full mailbox access. Then I remembered the account I use has full mailbox access to that account's mail .

Disabled the access and tried again, prompts for logon and then displays cached mail just as you are seeing.

Now that i think about it it makes sense the cache is stored in the user profile of the generic account you are using, so everyone using that account has access the the cached data. Even though you choose a different outlook profile the main account is the same and as such knows nothing of the outlook account. So it just pulls the cache from the user profile.

Disable cached mode or seperate accounts for all security risks( ie: users ) you allow to log on the the domain.

Hope that makes sense.

Someone else may know better but as far as I can tell its working as intended atm.

[Edit]

Found another option that may work for you, not sure if this is only a 2007 feature. There is an option in the properties for the outlook data "*.ost" file always prompt for credentials which forces paswword verification and wont open the cache file without it. Not sure if outlook 2003 has this option but it might have something similar in the data file properties.

[/Edit]

[Steve Emmons]

I think Rick is right that you should setup seperate active directory accounts for each user. The outlook ost files are going to be stored with the user's profile so I don't think you can keep people out of other outlook profiles.

I know that you can set a local password on a pst file, but not sure about the ost (cached file). I'm not on a domain any longer to test.

If they have seperate AD accounts and the users don't have demanding email needs you could have them use OWA and not have to bother with Outlook at all.

[Keith Peppiatt]

I agree AD is the better solution but not really suitable for this "kiosk" type PC and the number of users concerned.

the 2007 option sounds like could be a way forward - we're not quite ready to make the move on the application front and its not in 2003 but thanks for the pointer.

At present looks like OWA is the preferred option.

[Ricky Willox]

OWA never thought of that . Good solution really pretty much full functionality from a web client.

Might just wanna check on the security aspect though if one user logs on and does not log off properly or does not close the browser, IE might cache the credentials and reuse them.

Enable forms based auth in exchange should get round any problems like that if they exist.

[Steve Emmons]

OWA with Exchange 2003 is excellent. With Exchange 2000 not quite as good, but probably acceptable.

Yes, look at the login screen for OWA. There is an option to "save password" I think, but also think there is a way to disable it. As you said, forms-based authentication may be the key.