Exchange Federation - Free \ Busy showing location and subject details regardless of setting

G'Da All,

I have a big issue with a federation I just setup.  The external organisation is able to see the full appointment details of local organisation users.

 Back ground: the local org is Exchange 2007 mailbox server, 2007cas and 2010 CAS.  External org is fully Ex2010.  Ex2007 is SP3, and Ex2010 is SP2.

 User is Local Org cannot see the details of the another Local Org user free\busy.  It can only see if he is free or busy.

User in External Org can see the details of Local Org user.

The Organisational Relationship has been set to only show Times.

New created accounts (9 months or newer) in Local Org do not have the problem.

I have checked mailbox properties between good and bad accounts, permissions, etc.  Nothing obvious.

 I know that Ex2007 does no use sharing policy but the orgrelationship should filter that.

 

I have tested the issue with several accounts.  The new accounts did not show the appointment details but the older accounts did.  We are not aware of any process, script, installation of third party software that could have change the permissions in Exchange \ AD.  This is my suspicion.