Can you scan through the Tracking Logs for her email address? Is that feasible considering your backup situation?
If so, scan for her ID and see what she sent. Nate Couch EDS messaging -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Webb, Andy Sent: Tuesday, August 09, 2005 8:22 AM To: Exchange Discussions Subject: RE: Log ins to Exchange and Network You could look at message sent times, but that only gives you instantaneous data points (I could send mail at 8am and 5pm and loaf in between). If it was OWA and you have IIS HTTP logs, then there's some data. If you have a large collection of message tracking log files there's some data. If you have a backup of the mailbox there's some data. But none of it really goes to prove an amount of work. The SBS server might have Windows Security Event Logs with authentication data, but that's not a reliable way to prove a person was performing the action either. I would think the burden would be on the employee to have documented any work performed on an ongoing basis and on the management to have approved those timesheets on an ongoing basis. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Stark Sent: Monday, August 08, 2005 12:32 PM To: Exchange Discussions Subject: Log ins to Exchange and Network I have a client running SBS2003. They have a peculiar situation with an employee that left a few weeks ago that is now claiming he/she worked nearly twice as many hours as he/she was paid for. Unfortunately, the email account has already been deleted, so I can't look at the email history to see what evidence there was there. Other than what can be collected from co-workers, which is minimal. So, I was wondering if there are any existing logs I could easily pull up that would be more complete and would go back as far as 1 year ago (August 2004). I have backups, but I don't think they go back that far. I have to go onsite to check that out in more detail. I'll report to the list if this detail sheds more light. If my backup does show some promise, what process would I use to restore the mailbox? I'm not as familiar with SBS2003 as I would like to be, especially under these circumstances. Everyone's help on this delicate matter is appreciated David Stark Alaska _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange To subscribe: http://e-newsletters.internet.com/discussionlists.html/ To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange To subscribe: http://e-newsletters.internet.com/discussionlists.html/ To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/read/?forum=exchange To subscribe: http://e-newsletters.internet.com/discussionlists.html/ To unsubscribe send a blank email to [EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] To unsubscribe via postal mail, please contact us at: Jupitermedia Corp. Attn: Discussion List Management 475 Park Avenue South New York, NY 10016 Please include the email address which you have been contacted with.
