Work colleague has access to my outlook inbox

russell664 · 6 Nov 2014 at 12:03

I work as Admin staff in a fostering agency, and I know everyones login details in my department. Not at request of the manager, but more down the the fact I also act as IT support to a degree.

I sometimes get asked the access my managers emails for him, but everyone is fine with the fact I can login, because again it only ever happens when there is an issue, and there is a sense of trust in the office.

I can understand the frustration with this, however, as said above work email is for work reasons, not so much for personal use; I have my Gmail for that.

Delvis · 6 Nov 2014 at 12:05

Er, you still shouldn't know everyone's passwords....unless they have told you them of course....

russell664 · 6 Nov 2014 at 12:07

Of course they have told me them, that's the whole point.

When it comes to new staff, I set them up, and hand them their passwords for them to change to whatever they like, I only ever know the password if they are having issues/had in the past etc...

cHk4 · 6 Nov 2014 at 12:11

Isn't that a breach of data protection?

Nitefly · 6 Nov 2014 at 12:27

Am I missing something here? I don't see what's wrong with this at all. People have access to my inbox - how else would anyone know what to do if I was ill / emergency and something came in that needed dealing with?

Perhaps I'm missing the freelancer point and this is a personal email address? Probably.

neil_g · 6 Nov 2014 at 12:31

youre lucky, you wouldnt even have email if you freelanced here.

but as someone else said, as a freenlancer its probably for when you aren't working. generally most employers cover the "all of your emails can/will be monitored" thing in your contract within an internet/email policy.

we wont give anyone access to other mailboxes without written request from HR/line manager.

how on earth are you adding your own mailbox anyway?

jellybeard999 · 6 Nov 2014 at 12:31

cHk4 said:
Isn't that a breach of data protection?

Not if it's not personal data.

neil_g · 6 Nov 2014 at 12:33

russell664 said:
When it comes to new staff, I set them up, and hand them their passwords for them to change to whatever they like, I only ever know the password if they are having issues/had in the past etc...

opening yourself up to a whole world of potential pain if/when theres a data leak.. "oh russell knew all of the passwords..".

distance yourself from that poop.

e: oh and for the love of god set up some form of webmail.

XeNoN89 · 6 Nov 2014 at 12:43

I work in IT and get requests from managers to do this with people quite often. it's normal and shouldn't be an invasion of privacy as you shouldn't be using your work email for personal stuff anyway.

Gman · 6 Nov 2014 at 12:51

as already said you should treat your works email only for work, assume anything sent and received can be viewed by anyone.

at my works ALL incoming and outgoing email are monitored and read by hr

DaleTheWhale · 6 Nov 2014 at 12:51

Permissions and actual access are completely different, he would need to have your inbox setup on his laptop/PC, which will normally require your password.

Just remove the permissions yourself or ask your helpdesk/HR whoever manages it.

Janesy B said:
Just because he has permissions, doesn't means he knows he has the permission and has your inbox open on his outlook client. By all means kick off and post the outcome, it will be hilarious.

Just saw this as well saying the same.

Please cause a massive uproar and fuss.

neil_g · 6 Nov 2014 at 12:53

ThaReaperGuy said:
Permissions and actual access are completely different, he would need to have your inbox setup on his laptop/PC, which will normally require your password.

Just remove the permissions yourself or ask your helpdesk/HR whoever manages it.

mmm.. depends. if you give permissions in outlook on an exchange environment i dont believe you need the other users logon.

been a while since ive done it that way though, normally its an AD change rather than outlook.

Fireskull · 6 Nov 2014 at 13:12

Nitefly said:
Am I missing something here? I don't see what's wrong with this at all. People have access to my inbox - how else would anyone know what to do if I was ill / emergency and something came in that needed dealing with?

Perhaps I'm missing the freelancer point and this is a personal email address? Probably.

This, other than the freelance bit, isn't this common that colleagues can access inboxes when someone is on holiday etc if they share work?

slinxy · 6 Nov 2014 at 13:22

neil_g said:
mmm.. depends. if you give permissions in outlook on an exchange environment i dont believe you need the other users logon.

been a while since ive done it that way though, normally its an AD change rather than outlook.

permissions can be managed by the end user in a client like OL or/and exchange admin.

If the end user has given the permission, then normally the other user needs to add the account/mailbox but they should not need the end users username and password; if its done correctly.

If the exchange admin has added it, it normally just appears when the exchange settings heartbeat hits the machine.

I tend to try and manage the permissions via exchange admin role as 'end users' normally make a mess out of it.

grumpysculler · 6 Nov 2014 at 13:50

Gman said:
at my works ALL incoming and outgoing email are monitored and read by hr

Don't they have real jobs to do?

Or does your company employ dedicated email readers at great cost?

Our email can be monitored (as can web access), but nobody gives a toss unless disciplinary or legal action is involved.

neil_g · 6 Nov 2014 at 14:00

slinxy said:
permissions can be managed by the end user in a client like OL or/and exchange admin.

If the end user has given the permission, then normally the other user needs to add the account/mailbox but they should not need the end users username and password; if its done correctly.

If the exchange admin has added it, it normally just appears when the exchange settings heartbeat hits the machine.

I tend to try and manage the permissions via exchange admin role as 'end users' normally make a mess out of it.

yeah thats what i thought.

grumpysculler said:
Don't they have real jobs to do?

Or does your company employ dedicated email readers at great cost?

Our email can be monitored (as can web access), but nobody gives a toss unless disciplinary or legal action is involved.

i suspect he meant they "can" monitor email at will rather than that they sit there all day monitoring it

Rroff · 6 Nov 2014 at 14:36

Nitefly said:
Am I missing something here? I don't see what's wrong with this at all. People have access to my inbox - how else would anyone know what to do if I was ill / emergency and something came in that needed dealing with?

Perhaps I'm missing the freelancer point and this is a personal email address? Probably.

We have a bit of a weird situation (but no one currently working here permanently cares) with this where its supposed to be a manager that has certain logins/permissions incase someone is sick or on holiday but also certain members of normal staff have it due to having been there so long and are trusted. Does cause a bit of an issue with new starters and short term contract staff, etc.

platypus · 6 Nov 2014 at 15:01

Nitefly said:
Am I missing something here? I don't see what's wrong with this at all. People have access to my inbox - how else would anyone know what to do if I was ill / emergency and something came in that needed dealing with?

Eugh the downside of avoiding this (welcome to an Enterprise) is that you and everyone else gets copied into emails so "everyone" knows about "everything", whereas in reality you start to ignore most unless they are directly addressed to you..

Clav · 6 Nov 2014 at 16:38

Your predecessor probably delegated access to this person and then they renamed his account when you joined. Nothing sinister

Pawnless Endgame · 6 Nov 2014 at 16:50

Clav said:
Your predecessor probably delegated access to this person and then they renamed his account when you joined. Nothing sinister

I guess it must be this. At a previous workplace back in 2000/1, my email address was something like [email protected], which obviously have been recycled. Someone who I didn't know, not even in the same building as me, mounted my mailbox into his Outlook. Eventually I found out, and turns out he was a bit of a troublemaker anyway. I was able to turn inbox permissions off without having to raise a ticket with IT.

Kinda related: Outlook at my current workplace share our calendars to everyone by default. My manager has asked me to find out how to restrict that so that only her + us (8 of us) can see each other's calendars. I can see where you can add the 8 people, but how do you lock it out from the rest of the firm? Outlook 2003 btw.