How private are private items in Exchange

<span id="hs_cos_wrapper_name" class="hs_cos_wrapper hs_cos_wrapper_meta_field hs_cos_wrapper_type_text" style="" data-hs-cos-general-type="meta_field" data-hs-cos-type="text" >How private are private items in Exchange</span>

Twan van Beers
09 August, 2015

We sometimes get asked how private are private items?

The short answer is not very… private items is an Outlook and OWA concept and NOT an Exchange concept. Exchange has no item level security model, only mailbox and folder level.

So what does this mean?

This means that unless you can force people to only access your mailbox via Outlook and OWA, then do NOT delegate your mailbox/folders if you expect private items to be 100% private. Other methods like WebDAV, EWS, ActiveSync and any myriad of other mail access methods will NOT honour private items. Instead they will be downloaded just like any other message.

Oh no! So what else can you do?

Using encryption like S/MIME or AD RMS will prevent others from reading your mail, as long as they don’t have the private key to your certificate in the case of S/MIME, and as long as they can’t hijack your email address in the case of AD RMS (and the correct RMS template was used to prevent others from reading)

The proof…

Right so we’ve created two users TwanBoss and TwanDelegate.

TwanBoss delegates his mailbox to TwanDelegate

TwanBoss delegates to TwanDelegate

TwanBoss then creates some private items, I’ve used calendar item and task, but it doesn’t really matter what the item type is.

TwanBoss creates a private task

TwanBoss creates a private appointment

Now in Outlook all is well, TwanDelegate sees the calendar item marked as ‘Private Appointment’ but cannot open it. Also with MFCMapi or OutlookSpy you can’t see any protected content. However some simple PowerShell scripting (and using only the Delegate’s credentials) we get the whole appointment…

PS C:\Users\Twan> $MailboxName = "TwanBoss@nbcmt.neroblanco.co.uk" PS C:\Users\Twan> $StartDate = new-object System.DateTime(2015, 08, 10) PS C:\Users\Twan> $EndDate = new-object System.DateTime(2015, 08, 13) PS C:\Users\Twan> PS C:\Users\Twan> $dllpath = "C:\Program Files\Microsoft\Exchange\Web Services\2.2\Microsoft.Exchange.WebServices.dll" PS C:\Users\Twan> [void][Reflection.Assembly]::LoadFile($dllpath) PS C:\Users\Twan> $service = New-Object Microsoft.Exchange.WebServices.Data.ExchangeService([Microsoft.Exchange.WebServi ces.Data.ExchangeVersion]::Exchange2007_SP1) PS C:\Users\Twan> PS C:\Users\Twan> $service.credentials = New-Object System.Net.NetworkCredential( "TwanDelegate@nbcmt.neroblanco.co.uk", "*********" ) PS C:\Users\Twan> PS C:\Users\Twan> PS C:\Users\Twan> $service.AutodiscoverUrl($MailboxName) PS C:\Users\Twan> PS C:\Users\Twan> $folderid = new-object Microsoft.Exchange.WebServices.Data.FolderId([Microsoft.Exchange.WebServices.D ata.WellKnownFolderName]::Calendar,$MailboxName) PS C:\Users\Twan> $CalendarFolder = [Microsoft.Exchange.WebServices.Data.CalendarFolder]::Bind($service,$folderid) PS C:\Users\Twan> $cvCalendarview = new-object Microsoft.Exchange.WebServices.Data.CalendarView($StartDate,$EndDate,2000 ) PS C:\Users\Twan> $cvCalendarview.PropertySet = new-object Microsoft.Exchange.WebServices.Data.PropertySet([Microsoft.Ex change.WebServices.Data.BasePropertySet]::FirstClassProperties) PS C:\Users\Twan> $frCalendarResult = $CalendarFolder.FindAppointments($cvCalendarview) PS C:\Users\Twan> PS C:\Users\Twan> foreach ($apApointment in $frCalendarResult.Items){ >> $psPropset = new-object Microsoft.Exchange.WebServices.Data.PropertySet([Microsoft.Exchange.WebServices.Data.Bas ePropertySet]::FirstClassProperties) >> $apApointment.load($psPropset) >> $apApointment | fl >> } >> Start : 10/08/2015 08:00:00 End : 10/08/2015 08:30:00 OriginalStart : IsAllDayEvent : False LegacyFreeBusyStatus : Busy Location : When : IsMeeting : False IsCancelled : False IsRecurring : False MeetingRequestWasSent : False IsResponseRequested : True AppointmentType : Single MyResponseType : Unknown Organizer : TwanBoss <SMTP:TwanBoss@NBCMT.neroblanco.co.uk> RequiredAttendees : {TwanBoss} OptionalAttendees : {} Resources : {} ConflictingMeetingCount : AdjacentMeetingCount : ConflictingMeetings : AdjacentMeetings : Duration : 00:30:00 TimeZone : (UTC) Dublin, Edinburgh, Lisbon, London AppointmentReplyTime : AppointmentSequenceNumber : 0 AppointmentState : 0 Recurrence : FirstOccurrence : LastOccurrence : ModifiedOccurrences : DeletedOccurrences : StartTimeZone : EndTimeZone : ConferenceType : 0 AllowNewTimeProposal : True IsOnlineMeeting : MeetingWorkspaceUrl : NetShowUrl : ICalUid : 040000008200E00074C5B7101A82E00800000000300798244DD3D001000000000000000010000000EFB2C00E 742D0F428B8E3CD4742A0969 ICalRecurrenceId : ICalDateTimeStamp : 10/08/2015 10:04:50 EnhancedLocation : JoinOnlineMeetingUrl : OnlineMeetingSettings : IsAttachment : False IsNew : False Id : AQMkADViY2UxMDc2LWNmZTUtNDg1OS1hYjU0LWQyMGRlZGQAMTBmOWMARgAAAycY3EhvWmBNvsnINJSFUBwHAFug dGnAXllKhQSVSg8yw7QAAAIBDQAAAFugdGnAXllKhQSVSg8yw7QAAAINOAAAAA== MimeContent : ParentFolderId : AQMkADViY2UxMDc2LWNmZTUtNDg1OS1hYjU0LWQyMGRlZGQAMTBmOWMALgAAAycY3EhvWmBNvsnINJSFUBwBAFug dGnAXllKhQSVSg8yw7QAAAIBDQAAAA== Sensitivity : Private Attachments : {} DateTimeReceived : 10/08/2015 09:15:47 Size : 7316 Categories : {} Culture : en-GB Importance : Normal InReplyTo : IsSubmitted : False IsAssociated : IsDraft : False IsFromMe : False IsResend : False IsUnmodified : False InternetMessageHeaders : DateTimeSent : 10/08/2015 09:15:47 DateTimeCreated : 10/08/2015 09:15:56 AllowedResponseActions : Forward ReminderDueBy : 10/08/2015 08:00:00 IsReminderSet : False ReminderMinutesBeforeStart : 15 DisplayCc : DisplayTo : TwanBoss HasAttachments : False Body : <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="Generator" content="Microsoft Exchange Server">  <style></style> </head> <body> <font face="Calibri" size="2"><span style="font-size:11pt;"> <div>This is my private appointment</div> <div> </div> </span></font> </body> </html> ItemClass : IPM.Appointment Subject : Boss Private Appointment WebClientReadFormQueryString : WebClientEditFormQueryString : ExtendedProperties : {} EffectiveRights : Read LastModifiedName : TwanBoss LastModifiedTime : 10/08/2015 10:04:50 ConversationId : UniqueBody : StoreEntryId : InstanceKey : Flag : NormalizedBody : EntityExtractionResult : PolicyTag : ArchiveTag : RetentionDate : Preview : TextBody : IconIndex : Schema : {MimeContent, Id, ParentFolderId, ItemClass...} Service : Microsoft.Exchange.WebServices.Data.ExchangeService IsDirty : False PS C:\Users\Twan>

Twan van Beers

Twan is a senior consultant with over 30 years of experience. He has a wide range of skills including Messaging, Active Directory, SQL, Networking and Firewalls. Twan loves to write scripts and get deep and dirty into debugging code, in order to understand and resolve the most complex of problems.