Re: Somebody is Snooping around in my users mailbox....
From: Melissa Travers [MSFT] (mtravers_at_online.microsoft.com)
Date: 03/15/04
- Next message: PINO: "undeliverable mail"
- Previous message: Kelly Smothers: "OWA issues (double clicks and vanishing 'reply'"
- In reply to: The Poster: "Somebody is Snooping around in my users mailbox...."
- Messages sorted by: [ date ] [ thread ]
Date: Mon, 15 Mar 2004 11:42:21 -0500
This is something that is very difficult to tell with any certainty. For
instance say this admin uses the Administrator account. This is also the
account that the backup agent or anti-virus is using. So when you look
under Mailbox Resources to see who accessed the account, it may show the
Admin account, but this could have been due to a backup or virus scan.
Another example is this:
John has permissions to Mary's calendar. John opens Mary's calendar by
going to File-Open-Other Users Folder. This will appear as if John accessed
her mailbox, even though he only viewed her calendar.
Here are some relevant articles that go into more detail:
812007 ADM: Exchange Records Event 1016 in the Event Log For Both Valid and
http://support.microsoft.com/?id=812007
274317 XADM: How to View Windows NT Accounts that Access Mailboxes in
Exchange
http://support.microsoft.com/?id=274317
301328 OL2002: Event ID 1016 Appears When You Use Outlook 2002
http://support.microsoft.com/?id=301328
173692 Event 1016 Generated When You Open Mailbox or Schedule of Another
User
http://support.microsoft.com/?id=173692
244305 XADM: Event ID: 1016 Generated by a Virus Scan Software Account
http://support.microsoft.com/?id=244305
These are still relevant to E2k and E2k3.
Although Mailbox Resources is useful to show when someone logs into their
mailbox (or someone else's), it has a few limitations:
1) It doesn't show what folder was being logged into (i.e. Inbox, Calendar,
Contacts, etc...)
2) It cannot be used as a security log to definitively show a mailbox was
accessed
by an unwanted party.
Hope this helps.
-- Melissa Travers, MCSE Microsoft Exchange Support Please do not send email directly to this alias. This alias is for newsgroup purposes only. This posting is provided "AS IS" with no warranties, and confers no rights. "The Poster" <nospam@nospam_dontyoudare.net> wrote in message news:%23qDWFEqCEHA.1484@TK2MSFTNGP12.phx.gbl... > G/day forum, > > Is there any way of tracing mailbox access on my domain? I've got Exchange > 2000 in a native Windows 2000 environment. > > I want to detect if one of my admins are over using there power in having > free for all access to users mailboxes. > > Regards, > The Poster. > >
- Next message: PINO: "undeliverable mail"
- Previous message: Kelly Smothers: "OWA issues (double clicks and vanishing 'reply'"
- In reply to: The Poster: "Somebody is Snooping around in my users mailbox...."
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
