Yes, any sort of access to a mailbox by any account other than the Primary NT Account (as listed in the General page of the mailbox Properties) will generate an event of Type=Success Audit, Category=Logons (in Exchange 5.5 it is event 1016 ... don't have a 2k box handy).
You can only access the mailbox if you have the Mailbox Owner right as assigned at the server, or if the mailbox owner has granted permissions at the folder level within their mailbox. You can grant any account Service Account Access, this is a shotgun method for giving yourself access ... and it is bad practice to use the service account itself to log in. > -----Original Message----- > From: Saul [SMTP:[EMAIL PROTECTED]] > Sent: Friday, February 01, 2002 10:13 AM > To: Exchange Discussions > Subject: RE: User reading someone else's mailbox > > So theres really no sure way of finding out? I am just looking for the > Category and Event so that I can filter out the logs and look through > them. If someone shares a calendar and another user opens it, will that > cause an event? > > I created a dummy account to see what the event is and received a "you do > not have permissions to open this mailbox" message, I know this is a dumb > question, I have administrator rights but why do I get that message? If > only the service account can access that then how do you what the service > account is? > > I am running Exchange 2000 w/ W2KADV > > Thanks > > > There are events in the event log. Just look and you'll see. > > Unfortunately, these events do not tell you that someone has read the > > e-mail, just that they attempted to connect to the mailbox. Opening the > > user's calendar, for example, will trigger an event. Therefore, don't > > fire someone based solely on entries in the event log. > > > > Ed Crowley MCSE+Internet MVP kcCC+I > > Tech Consultant > > Compaq Computer Corporation > > Protecting the world from PSTs and Bricked Backups! > > > > > > -----Original Message----- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED]] On Behalf Of Saul > > Sent: Thursday, January 31, 2002 2:16 PM > > To: Exchange Discussions > > Subject: User reading someone else's mailbox > > > > > > How can we find out if someone has gained access to someone else's > > mailbox and reading their email? I know you can look at the event log > > but what do I look for? What is the Category and event it would log? > > > > Thanks > > > > _________________________________________________________________ > > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > > Archives: http://www.swynk.com/sitesearch/search.asp > > To unsubscribe: mailto:[EMAIL PROTECTED] > > Exchange List admin: [EMAIL PROTECTED] > > _________________________________________________________________ > List posting FAQ: http://www.swinc.com/resource/exch_faq.htm > Archives: http://www.swynk.com/sitesearch/search.asp > To unsubscribe: mailto:[EMAIL PROTECTED] > Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
