Admin audit trail (Need Help)

[mpaters]

Is there a way to log when an admin opens a users inbox when the admin is not the owner of the mailbox but has permissions to access it. I need a way to track when admins open other users mailboxes.


thanks to all,

 

[johnrmcc]

there must be a log that tracks access of each mailbox....i am looking for it now as well, as i need to see who has been accessing a certain mailbox at what times.

 

[N2PCS]

Make sure logging is enabled from the system manager.

Look for Event ID 1016 in the Application Log.

http://www.winnetmag.com/Article/ArticleID/23750/23750.html

 

[johnrmcc]

is this the same id in exch 2003?

 

[N2PCS]

I have been trying to find out for 2000/2003 but have not been able to confirm this yet.

I will update the thread if I can find the answer.

 

[johnrmcc]

ok, did some research. It seems in exch 2k, logging for this isnt turned on by default. You have to go into ESM, right click on server, properties, diagnostics logging, MSExchangeIS, and turn on at least minimum logging on access control and logons. Soon as I did that, check the application log on the server.