Auditing Logins to exchange mailboxes

[middi1]

Looking for either a way or a 3rd party solution to accomplish the following. Lets say I have computer A and computer B. Also lets say I login to my same mailbox using outlook(any version) from both computers. Now how could I run a report or distinguish when I logged into the mailbox and also from what computer? Also can this be traced per computer if they logged into the mailbox using OWA?

The reasoning our execs would like us to find out as some users are thinking that people are somehow logging into other mailboxes and deleting emails from their mailbox. That could be possible if they had the users password. How could we trace that back to the computer that logged into the mailbox at a certain day and time?

FYI-- We are using Exchange 2000 with SP3 and the rollover file. We are using outlook XP and 2003 not that should make a difference.

 

[xmsre]

For exchange, you should be able to get the info by turning up your diagnostic logging for logins. A 1016 will be logged in the application log when one user accesses another user's mailbox. Be aware that this includes when one user opens another user's calendar.

For OWA, you should find the info you are looking for in the IIS log. This will include the IP that connected to OWA. You can use logparser to parse the IIS logs out.

 

[fs483]

Have everyone change their passwords and not stick it under their keyboards or on the screen.