Re: Unauthorized Monitoring of Email

Chris Guimbellot wrote:
SBS2003.

Hello,

When the company I work for was purchased two years ago, I was required to give the administrative password to the new owner's son. In the past week, I have received many comments from users who suspect he is logging in remotely and monitoring users' email by going into their accounts and reading their messages. The first thing I would like to do is see if he is actually doing it. Is there some sort of alert that I can set up to tell me, or log when he logs in? I can look at the security log in event viewer, but there are so many events that have the Administrator name, I don't even know what they all mean. Also, currently the log only holds about a two days of events. I could increase the size, but it would start taking much more space on my hard drive. Less than one day of data is 65MB. Finally, I don't think the event logs are where I go to see if he is logging into other users' mailboxes. That said, are there any kind of events that I could look for in Exchange that might tell me what I need to know?

The security log is almost worthless as it stands. RRAS access will be
noted in the System log. Look around in RRAS admin for log enabling (I
can't remember if it's done by default). Check to see if your Internet
connection device can do logging, as that will show any kind of access.

Exchange admin will show the last logon and logoff for each mailbox. If
that's outside working hours, and the user doesn't have remote access...

.