exchange logging

[wanyph]

Hi,

My boss is thinking that someone is reading his mails.
I know that I can enable logging for the whole server (eventvwr).
But that is too much data for me.

Is there a way to enable detailed logging for just 1 mailbox?

 

[xmsre]

Default logging levels should log an event id 1016 whenever someone other than an owner accesses a mialbox. Be caureful, this event will be logged when you use open - other user's folder to view another user's mailbox also.

 

[wanyph]

Thanks for your information.
But I´m searching for a tool that can make some good reports.
for example:
which user opens another mailbox from which node.

mewi

 

[xmsre]

use the logparser tool to parse the application log.

 

[olaritter]

Hi
Are you sure about 1016? Cannot see that happening on my exchange server.
Is Exchange or DC (the domain controller computer) keeping log of mailbox permission changes and etc. Creating new accounts. Mainly interested if a log (history) of the mailbox access rights (permissions) is kept somewhere?

Please advise!

Regards.

 

[olaritter]

Or when one uses OWA to access someone else's mailbox, is that logged? longterm-wise? Other than seeing NT AUTHORITY as last logged user? Trying find already for sometime about these two posts of mine, but no luck so far.

Thankyou

 

[olaritter]

I'm looking an answer more towards this thread (with no answer) unfortunately: thread955-1138015

1. Is there automatic auditing?
2. Can I set?


regards,

Ola

 

[bytehd]

security auditing is a group policy (local on the exch box)
not sure if it audits mailbox-level AD login failures

you can also prevent login to his box for certain hours,
then see if there were any login attempts then.

get creative jones

George Walkey
Senior Geek in charge

http://www.insyncva.com