Exchange mailbox audit
Hi All,I need help to audit who is accessing mailbox for certain users.Where would I see the logs if an exchange admin is accessing users mailbox. (Mapping users mailbox for criminal intension)
I also have exchange admin access.Thanksfeel3sam
August 8th, 2009 12:46pm
You can set logon auditing on server basis but it is not possible to setup for certain users.
Exchange 2003:
Auditing Mailbox Access Using Exchange System Manager and Event Viewer
http://www.msexchange.org/tutorials/Auditing-Mailbox-Access-Exchange-System-Manager-Event-Viewer.html
Exchange 2007:
Increase Logons diagnostic logging to Low on Exchange Mailbox server with below cmdlet...
Set-EventLogLevel MSExchangeIS\9000 Private\Logons -Level
Then look for event id 1016 in application event log....
Amit Tank | MVP Exchange Server | MCITP: EMA | MCSA: M | http://ExchangeShare.WordPress.com
Free Windows Admin Tool Kit Click here and download it now
August 8th, 2009 1:11pm
Amit,Thanks for the help and support.Appreciated.
August 8th, 2009 1:25pm
Amit have provided the solution.The KB article for this issue:http://support.microsoft.com/default.aspx/kb/867640- Elvis
Free Windows Admin Tool Kit Click here and download it now
August 10th, 2009 9:38am