Can I see if an administrator is reading others e-mail?

[abuchan]

We may have a security violation and we need to check and see if an administrator has beeen reading and compling e-mail from others in the AD. Is there a way to do this? Thank-you.

 

[yanks2112]

Hi abuchan,

If you go into the Exchange System Manager Expand Administrative Groups, expand your Admin Group, expand Servers and right click on your server. Click on the Diagnostics Logging tab. Select and expand MS ExchangeIS. Highlight Mailbox. In the right window highlight Logons.
I have mine set to Minimum which serves the purpose for viewing logons. You may want to experiment to see which is right for you. Be aware that the Application log fills quickly, even with minimum loigging set

Hope this helps

 

[paulha]

Im not sure if auditing logons will do it for you, as far as I am aware, accessing a shared calendar is considered a logon by the server?

Might be worth reposting in the forensic forum

http://www.tek-tips.com/threadminder.cfm?pid=83