Remember that the event doesn't really tell you how or what was accessed, it doesn't necessarily mean that he actually logged into the mailbox. He must have some sort of rights to access to these 10 mailboxes? Maybe he has set them up as additional mailboxes that open when he starts Outlook? Perhaps when his client starts, connections are made to those 10 mailboxes and that's what's generating the events ...
The other thing to check would be antivirus ... To scan mailboxes, an NT account is used ... Maybe he's configured his own account to run the scan (who knows why). Sakti -----Original Message----- From: McCready, Robert [mailto:[EMAIL PROTECTED] Sent: Tuesday, 18 May 2004 6:58 AM To: Exchange Discussions Subject: Event ID 1016 Greetings, We have two Exchange Admins. Last week, at 8:30 Am, the event log for Exchange 5.5 says that one of our Admins logged onto 10 mailbox's in 2 seconds. Of course, he did not. He wasn't even here at that time. If I open Exchange Admin, then the Private Information Store and check LOGONS, it shows his Windows NT Account username under those 10 mailboxes. Anybody have any idea why Exchange would report that he accessed 10 mailboxes (with Event ID 1016), even though he wasn't at work? Plus, it's just physically impossible to log into 10 mailboxes in two seconds. He did not have any meetings scheduled at the same time. The account is not being used as a Service Account. These 10 mailboxes were also all people on the Network Team, not just Joe User 1 and Joe User 2. Odd and perplexing. Thanks. Robert _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; lang=english To unsubscribe send a blank email to %%email.unsub%% Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. ********************************************************************** This message is intended for the addressee named and may contain privileged information or confidential information or both. If you are not the intended recipient please delete it and notify the sender. ********************************************************************** _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang=english To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with.
