RE: Opening other user's inbox

Ben Winzenz Wed, 03 Apr 2002 12:47:02 -0800

Title: RE: Opening other user's inbox

Did you look at the Q article that I posted???

Event 1016 Generated When You Open Mailbox or Schedule of Another User (Q173692)

The information in this article applies to:

Microsoft Exchange Server, versions 5.0 , 5.5

SYMPTOMS

When you attempt to access another user's mailbox or schedule, Microsoft Exchange generates the following event in the Application Event log:

Event ID: 1016
Source: MSExchangeIS Private
Type: Success Audit
Category: Logons
NT User DOMAIN\username logged on to John Doe mailbox, and is not the primary Windows NT account on this mailbox.

This occurs even if you have permission to access the mailbox, and it occurs regardless of whether your attempt is successful or unsuccessful.

CAUSE

This behavior is by design.

Exchange records Event 1016 in the Event Log regardless of how you set the diagnostics logging level on the Information Store.

The decision to log this error was made with security in mind. It is important that any possible security breach be logged. If this type of logging were suppressed, an actual breach of security would not be logged.

Ben Winzenz, MCSE

Network/Systems Administrator

Peregrine Systems

-----Original Message-----
From: Matthew Carpenter [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, April 03, 2002 3:51 PM
To: MS-Exchange Admin Issues
Subject: RE: Opening other user's inbox

Can someone please confirm what I said earlier?

That event is logged when someone reads another user's calendar, not just when they access their mail.

-----Original Message-----
From: Ben Winzenz [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, April 03, 2002 2:28 PM
To: MS-Exchange Admin Issues
Subject: RE: Opening other user's inbox

I can always try, but rarely if ever, will I succees... (hehe).

Ben Winzenz, MCSE
Network/Systems Administrator
Peregrine Systems

-----Original Message-----
From: Ely, Don [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, April 03, 2002 2:58 PM
To: MS-Exchange Admin Issues
Subject: RE: Opening other user's inbox

Oh sure!! Outdo me why don't you... :P

Don Ely
Network Engineer
Tripath Imaging, Inc.
(336) 290-8293 - Direct
(336) 516-4519 - Mobile
[EMAIL PROTECTED] - email
http://www.tripathimaging.com

-----Original Message-----
From: Ben Winzenz [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, April 03, 2002 2:57 PM
To: MS-Exchange Admin Issues
Subject: RE: Opening other user's inbox

I'm going to add a comment also, because we had a similar situation. You
are referring to event 1016 in the Application log, correct? This event
actually gets logged whether the attempt to access the resource was
successful or not. Take a look at Q173692. This should answer your
question.

Ben Winzenz, MCSE
Network/Systems Administrator
Peregrine Systems

-----Original Message-----
From: Ely, Don [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, April 03, 2002 12:22 PM
To: MS-Exchange Admin Issues
Subject: RE: Opening other user's inbox

Let me add some flavor to this...

Tools,
Options,
Delegates,
Enough said.

Don Ely
Network Engineer
Tripath Imaging, Inc.
(336) 290-8293 - Direct
(336) 516-4519 - Mobile
[EMAIL PROTECTED] - email
http://www.tripathimaging.com

-----Original Message-----
From: James Winzenz [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, April 03, 2002 12:19 PM
To: MS-Exchange Admin Issues
Subject: RE: Opening other user's inbox

Check the permissions in exchange admin to the mailboxes in question.

James Winzenz, MCSE, A+
Associate Systems Administrator
Peregrine Systems, Inc.

-----Original Message-----
From: Nelson Aguillon [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, April 03, 2002 12:16 PM
To: MS-Exchange Admin Issues
Subject: RE: Opening other user's inbox

It is Exchange 5.5!

Nelson

-----Original Message-----
From: Clayton [mailto:[EMAIL PROTECTED]]
Sent:   Wednesday, April 03, 2002 9:10 AM
To:     MS-Exchange Admin Issues
Subject:        RE: Opening other user's inbox

Have the people who's mailboxes are being opened delegated this to the
people who are opening them?

Is this Exchange 5.5?

By default no one should be able to access other users stuff, so check to
see if folks have delegated, otherwise, in the Exchange Management, you can
edit the properties of the mailboxes to deny access.

-----Original Message-----
From: Nelson Aguillon [mailto:[EMAIL PROTECTED]]
Sent: April 3, 2002 1:06 PM
To: MS-Exchange Admin Issues
Subject: Opening other user's inbox

Hello everyone,

How do I prevent users from using the option to open other user's Inbox
(FILE, OPEN, OTHER USER'S FOLDER...)? Is this a default setting?

The application section of the Event Viewer is reports that several
individuals were logging on to other employee's mailbox when they were not
the primary NT account users.

Thanks in advance,