How to generate logon statistics of a user

[oyazo]

Hello All,

My client use exchange 2007 platform. A user reported that someone is fraudulently using his mailbox to send mail.

I have been mandated to generate all logon statistics (the ip address and hostname of the machine that was used to access his mailbox from November 2007 to December 3 2008)

This report will be used to track whoever has been fruadulently using the said mailbox to send mail.

I will appreciate every contribution to this.

Thank you.

Oyazo

 

[58sniper]

What makes him think this is the case? It could be someone is spoofing his address.

Auditing in the event logs should show this if it's properly enabled. It won't show the host name, but it will show the user name.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[Zelandakh]

There is an event you can generate to show logon access and workstation name if they are logging on as that user to Windows.

Logging on to Exchange / Outlook as another user is more tricky to audit especially since you should not be configured to allow that.

Why not just change the punter's password? Then the account cannot be used by anyone else.