Software

Ask something
Discussion Locked

Tracking NT users within Exchange

0 helpful
5 replies

by nsa13

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have a user that suspects that his email box is compromised. How would I go about tracking his mailbox to determine what NT user account accessed his email and when.

For example, if the user (NTDOMAIN\LUSR1) is the rightful owner of a mailbox then how can I find out if his cubemate NTDOMAIN\JHCKR) is accessing his mailbox.

I checked the tracking logs and while it gives me message-ids, times, dates, and recipients, it doesn't give me the NT user name that actually sent the email on behalf of the Exchange email box.

Is there a central place or a hidden log or tracking file that I can use to enumerate an exchange email account to an NT account and the times and dates of those accesses?

Thougts?

Thanks!!

5 replies

by joevano

Try looking in the Application Event Log on the NT server where the Exchange Server resides. Our exchange server posts a log event everytime a mailbox is accessed by someone other than the Primary NT Account of the mailbox. The log also includes theNT user account accessing the mailbox. I believe for this to work you must have the Audit Logon and Logoff enabled in NT User Manager for Domains.

by pozotech

The above is correct and works only if login is turned on in user manager. The other problem is does the 2nd user have the 1st users id and password. The 1st user should change password and then track access to the mailbox.

This discussion is closed to new replies.