Re: Exchange & Windows 2000 Security IP Logging

From: ThePsyko (thepsyko_at_itookmyprozac.com)
Date: 06/25/03

  • Next message: Burzek: "Re: Secure.exe problems after last auto upgrade" 
    Date: Wed, 25 Jun 2003 10:23:33 GMT

    On 24 Jun 2003 in microsoft.public.win2000.security, paul.perkin@talk21.com
    (Paul Perkin) made his/her contribution to mankind by stating in
    news:c9956aa5.0306240439.1b536f69@posting.google.com:

    > The email is accessed through
    > exchange webmail (outlook).
    >

    That's all you need then.. create another account for user1, forward all
    email from his old account to the new one.. then set a simple password on
    the old account... when user2 cracks the password, you'll have his IP
    address in the logs .. just grep something along the lines of "......
    mailbox=user1" at the end of the query.. if your logs are huge, just use
    the DOS Find command to locate that string 

    -- 
/(bb|[^b]{2})/ that is the Question
ThePsyko
Public Enemy #7
"God told me to skin you alive"
http://prozac.iscool.net
  • Next message: Burzek: "Re: Secure.exe problems after last auto upgrade"

    Relevant Pages

    • RE: Trace of 139 attack?
      ... Subject: Trace of 139 attack? ... The Administrator account can be locked out if too many ... deleting the logs he cannot do it. ...
      (Focus-Microsoft)
    • Re: FW: Trace of 139 attack?
      ... /complex—Forces passwords to have a mixture of upper ... > the admin account on local logins (physical security ... >> deleting the logs he cannot do it. ... >> ur Server ur logs will ...
      (Focus-Microsoft)
    • RE: Securty Audit Correlating
      ... exporting both(events and tickets) to a SQL/Access DB ... > viewer logs, so you can set filters for specific ... >>Currently we are outsourcing our account creation, ... >>After that generate a report. ...
      (Focus-Microsoft)
    • Re: Terminal Services Kiosk
      ... the locked-down account is the Active Directory account in ... the desktops, not the local accounts in the TS server. ... programs or kill the RD session? ... So one user logs in to the workstation ...
      (microsoft.public.windows.terminal_services)
    • RE: Slow file access
      ... This issue does appear to be isolate to the one account. ... Other Excel and other file types seem to be okay. ... The problem occurs no matter which PC this user logs onto. ... > Microsoft CSS Online Newsgroup Support ...
      (microsoft.public.windows.server.sbs)