Guide to the Secure Configuration and Administration of Microsoft ...

Networks.” Each KMSA needs to perform this task. To do so, select the CA object
under the site container and then select File/Properties and the “Administrators” tab.
Click “Change my KM Server Password”.
Consider requiring multiple KMSAs concurrence for certain KM related activities. No
specific recommendations are offered, as they would vary depending the sensitive of
the data being protected. To manage this feature, select the CA object under the site
container and then select File/Properties and the “Passwords” tab.
Enable mailboxes for advanced security. To do so for multiple mailboxes, go to the
“Enrollment” tab of the CA properties dialog box. To enable mailboxes individually,
select the mailbox under the recipients container and then select File/Properties
and the “Security” tab. Click on “Enable Advanced Security” and follow the on-screen
directions. It is not recommended to mail the user’s token.
It is recommended that you back up all KM server data files in the Kmsdata
subdirectory (for example, Exchsrvr\kmsdata\*.*) separately from other data and that
you make sure these backup tapes are stored in a more secure manner than your
everyday backups.
Exchange Client Outlook 97 Outlook 98
The recommended location of the file containing the user credentials on the client
machine is “%Systemroot%\Profiles\\Personal”. The suggested name is
“.epf”.
Exchange Client Outlook 97 Οutlook 98
Select medium or high level of password protection for user keys stored in the
registry.
Defining Access Rights from the Client
While there are no specific recommended security settings, it is important to understand
the power that users have to delegate access to their mailbox and to public folders which
they create. These access rights are implemented by users at the client – neither access
to the Exchange Administrator tool or membership in an Exchange Administrator Group
is required.
Via the client software package, users can grant others a wide range of access rights to
their mailbox that range from simple “reviewer” rights (read only) to “owner” rights, which
includes all the rights that can be associated with a mailbox. Obviously, this could cause
security concerns.
Also via the client, the user can set permission on folders he/she created. The access
rights that are associated with public folders also range from the relatively benign
40