The event logs will show you who's accessing what mailboxes. One way is to check the logs on the server and see who's doing what. The proof is in the pudding.
_________________ John Bowles Exchange Engineer OIG/HHS [EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of [EMAIL PROTECTED] Sent: Monday, January 05, 2004 3:32 AM To: Exchange Discussions Subject: Detect unauthorized access to mailbox by administrator Hi, I am a independent consultant hired to investigate an administrator who the CEO belives he is accessing sensative email from others mailbox. While it is NOT possible to configure anything on the exchange server, is there anything I can do a spot-check or any tools like sniffer, so that I can monitor any possible wrong-doing of the administrator? If you have any insight on this issue, please kindly drop me a line at [EMAIL PROTECTED] Cheers, Rick _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
