RE: Exchange access question

From: RH (RH@beulah.org)
Date: 08/06/01 

Message-ID: <C1D7075472B0D4118C2C00104B30451506A1B9@BHBC_EX01>
From: RH <RH@beulah.org>
To: 'Neil Smyth' <neil.smyth@statpro.co.uk>, 'Ben Jolly' <Ben.Jolly@Neonsys.com>, "'Schoonaert, Luk'" <LSchoonaert@TDSInternational.com>, Russell Munday <rmunday@syscap.com>, focus-ms@securityfocus.com
Subject: RE: Exchange access question
Date: Sun, 5 Aug 2001 19:17:05 -0400

You can also up the logging level on the information store to give much more
verbose information about mailbox connections. Click on the server object,
bring up it's properties and there is a logging tab there. Beware.. this
will put extra load on the server and fill the logs way more quickly!
Microsoft has some decent write ups on the logging settings if you search
the www.microsoft.com/technet site. Sorry .. don't know the specific Q
article number.

Ric

-----Original Message-----
From: Neil Smyth [mailto:neil.smyth@statpro.co.uk]
Sent: Friday, August 03, 2001 7:07 AM
To: 'Ben Jolly'; 'Schoonaert, Luk'; Russell Munday;
focus-ms@securityfocus.com
Subject: RE: Exchange access question

You also see this message if you have users that share their calanders, when
other people open the other users calander (even with just reviewer
permissions) you get this message in the event log, so it can be misleading.

NJS

-----Original Message-----
From: Ben Jolly [mailto:Ben.Jolly@Neonsys.com]
Sent: 22 May 2001 21:55
To: 'Schoonaert, Luk'; Russell Munday; focus-ms@securityfocus.com
Subject: RE: Exchange access question

To be more specific here is an example event out of an application log

Event Type: Success Audit
Event Source: MSExchangeIS Private
Event Category: Logons
Event ID: 1016
Date: 5/22/2001
Time: 2:20:47 PM
User: N/A
Computer: xxxxxxx
Description:
NT User 1 logged on to Users 2 mailbox, and is not the primary Windows NT
account on this mailbox.

-----Original Message-----
From: Schoonaert, Luk [mailto:LSchoonaert@TDSInternational.com]
Sent: Tuesday, May 22, 2001 2:16 PM
To: Russell Munday; focus-ms@securityfocus.com
Subject: RE: Exchange access question

Yes, you can check the eventlogs of your NT server (security logs) and also
in Exchange Administrator you go to your server's information store, there
you can find which account is logged on to which mailbox, when it accessed
and when it logged off...

Cheers
Luk

-----Original Message-----
From: Russell Munday [mailto:rmunday@syscap.com]
Sent: maandag 21 mei 2001 15:38
To: 'focus-ms@securityfocus.com'
Subject: Exchange access question

Hi all, quick question for any MS Exchange gurus.

Is it possible to track when someone's Inbox is opened? i.e. unauthorized
person accessing someone else's Inbox.

TIA

**********************************************************************
This email and any files transmitted with it are confidential and intended
solely for the use of the individual or entity to whom they are addressed.
If you have received this email in error please notify the system manager.

This footnote also confirms that this email message has been swept by
MIMEsweeper for the presence of computer viruses.

www.mimesweeper.com
**********************************************************************

The information in this message is confidential. It is intended solely for
the addressee. Access to this message by anyone else is unauthorised. If
you are not the intended recipient, any disclosure, copying, distribution
or any action taken or omitted to be taken in reliance on it, is prohibited
and may be unlawful. Any attachments to this message have been checked for
viruses, but please rely on your own virus checker and procedures. If you
contact us by e-mail, we will store your name and address to facilitate
communications.