Create a batch that will run a constant loop checking the size of the log on the REMOTE Exchange server (run the batch from your desktop if you can - or some other system he has no access to or is not aware of). If the log file grows in size - copy it to your machine - if it shrinks - end the loop and have it page you. The copy process should be a breeze since, as you said, he deleted the historical data.
Jerzy -----Original Message----- From: David Fortuna [mailto:[EMAIL PROTECTED]] Sent: Monday, April 08, 2002 9:02 AM To: Exchange Discussions Subject: Monitoring access I have an exchange 5.5 e-mail server running on Windows NT 4.0 server. I have a network tech that is accessing peoples mailboxes just for the sake of snooping. This is something I have had trouble prooving, everytime he does it he deletes the log created in the event viewer of the NT server. If there was a way to recover the event viewer it would be easy to prove. Is there a way within Exchange to prove something like this. I do not want to get him suspicous by removing his rights to access things. Please help!!! _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Archives: http://www.swynk.com/sitesearch/search.asp To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
