locked
Audit mailbox access by someone other than the mailbox owner RRS feed

  • Question

  • I configured this through the EMC GUI, Server Config/Mailbox/click on my only exchange server/Manage Diagnos…../9000 Private/Folder Access and Message Access and both set to HIGH. Restarted the IS and it logs everything (i.e. John accesing John). What I need it to do is when any user accesses any other users mailbox ONLY (i.e. John accesses Robert). Unsure what I am doing wrong.  Thank you in advance.

    Tuesday, March 22, 2011 5:49 PM

Answers

  • Hi Frank,

     

    In Exchange Server 2010 SP1, you can use ECP to check non-owner mailbox access report.

     

    Use Administrator account to log on OWA->Options->choose “Manage My Organization” ->Roles&Auditing->Auditing->Run a non-owner mailbox access report

     

    Thanks,

     

    Evan


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Friday, April 1, 2011 7:56 AM
    Moderator

All replies

  • Set it to two (not sure that will work through ui).  2 and 4 both log only when user A opens user B's mailbox.
    Thursday, March 24, 2011 10:45 PM
  • Thank you for the suggestion.  I am getting that but the problem is that it is logging everything meaning JOHN accessing JOHN's mailbox which is valid.  Makes it impossible to find someone accessing another users mailbox.  Please let me know if you can think of anything else and thanks again.
    Monday, March 28, 2011 7:54 PM
  • Hi Frank,

     

    In Exchange Server 2010 SP1, you can use ECP to check non-owner mailbox access report.

     

    Use Administrator account to log on OWA->Options->choose “Manage My Organization” ->Roles&Auditing->Auditing->Run a non-owner mailbox access report

     

    Thanks,

     

    Evan


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Friday, April 1, 2011 7:56 AM
    Moderator