General discussion

Locked

finding trails in outlook

By eduncan50 ·
We recently had to let someone go from our company. We disabled the login account for NT but left the e-mail account intact so it could be accessed by a different account. We now suspect somone snooped around in the mailbox using the that account and sent files to the deleted folder.
How can I check when the messages were received and what account opened them and when the were deleted?
we are using Outlook 97 exchange 5.5 on NT 4.0 and IIS.

Thanks

This conversation is currently closed to new comments.

5 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

finding trails in outlook

by dmiles In reply to finding trails in outlook

Go to server manager,and check the computer menu,the properties command should give you some details
The other thing that comes to mind is ,if there was Auditing enabled you may gather some info
Open User Manager for Domains
Select the domain command from the User menu and select the domain
Another choice would be to use Event Viewer which could give you some info

Collapse -

finding trails in outlook

by eduncan50 In reply to finding trails in outlook

Poster rated this answer

Collapse -

finding trails in outlook

by McKayTech In reply to finding trails in outlook

From Exchange Administrator, you can tell which account was last used to log on to the mailbox. Just expand the Private Information Store and double-click on Logons and it will give you the last access date, time and account used. The "gotcha" is that if you run a virus-scanning program that runs every night, it will have written over that information with the account it uses.

If you have implemented Deleted Item Recovery and are within the recovery window, from Outlook you can highlight the deleted items folder, then click Tools and Recover Deleted Items. You will then see a list of all the deleted items with the date and time they were deleted.

If neither of those work and you have implemented sufficient logging, you should see an Event Log entry any time someone other than the mailbox owner logs on to that account.

If none of those three pan out, you're probably out of luck in this particular case. In the future, you may want to consider either lengthening the Deleted Items Recovery period to 30-60 days on the mailboxes of departed employees or securing the mailbox at the time of departure by exporting the contents to a *.pst file and then disabling it altogether. If anyone needs access to the contents of the mailbox, they can import the archive into a folder in their mailbox.

paul

Collapse -

finding trails in outlook

by eduncan50 In reply to finding trails in outlook

Poster rated this answer

Collapse -

finding trails in outlook

by eduncan50 In reply to finding trails in outlook

This question was closed by the author

Back to Software Forum
5 total posts (Page 1 of 1)  

Related Discussions

Related Forums