Software

Ask something
Discussion Locked

Exchange2k - trusting Administrators

0 helpful
3 replies

by fimos

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi All,

I have a client with an exchange2k environment, they would like to separate the executives or at least gain some reasonable assurance that
IT isn't/can't read executive email. Exchange2k is configured by default to disallow administrator 'read' access to other person's mailboxes but this is easily changed. My thoughts are to put some sort of watch/trigger on the event logs on events such as an Administrator accounts accessing executive email. I suppose the easy answer is that we have to trust our Adminstrators, but, in this case I feel that the client will not buy into that level of trust.

I am looking for opinions for this problem?

On a similar note, what sort of 'key' events would you guys consider red flags for malicious activity e.g. (repeated login failures)?

3 replies

by timwalsh

The bottom line here is that you MUST trust your administrators at some point.

Here's my answer to those executives that want a guarantee that their administrators aren't reading their email/accessing their personal files:

Create a separate executive domain with its own Exchange server. Learn all aspects of the administrators job. Administer all aspects of the executive domain to include email. Don't bother your regular administrators when it all comes crashing down.

Two key points:

If you put enough roadblocks in place to prevent any savvy administrator bent on doing harm, from accomplishing his goal and covering his tracks, you will also prevent the honest administrator from doing his job.

If an executive has any reason to not trust his administrator (beyond "what if..." or "he might..."), then that administrator shouldn't be working for him.

This discussion is closed to new replies.