General discussion

Locked

Tracking NT users within Exchange

By nsa13 ·
I have a user that suspects that his email box is compromised. How would I go about tracking his mailbox to determine what NT user account accessed his email and when.

For example, if the user (NTDOMAIN\LUSR1) is the rightful owner of a mailbox then how can I find out if his cubemate NTDOMAIN\JHCKR) is accessing his mailbox.

I checked the tracking logs and while it gives me message-ids, times, dates, and recipients, it doesn't give me the NT user name that actually sent the email on behalf of the Exchange email box.

Is there a central place or a hidden log or tracking file that I can use to enumerate an exchange email account to an NT account and the times and dates of those accesses?

Thougts?

Thanks!!

This conversation is currently closed to new comments.

5 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

Tracking NT users within Exchange

by JoeVanO In reply to Tracking NT users within ...

Try looking in the Application Event Log on the NT server where the Exchange Server resides. Our exchange server posts a log event everytime a mailbox is accessed by someone other than the Primary NT Account of the mailbox. The log also includes theNT user account accessing the mailbox. I believe for this to work you must have the Audit Logon and Logoff enabled in NT User Manager for Domains.

Collapse -

Tracking NT users within Exchange

by nsa13 In reply to Tracking NT users within ...

Didn't meet the criteria

Collapse -

Tracking NT users within Exchange

by pozotech In reply to Tracking NT users within ...

The above is correct and works only if login is turned on in user manager. The other problem is does the 2nd user have the 1st users id and password. The 1st user should change password and then track access to the mailbox.

Collapse -

Tracking NT users within Exchange

by nsa13 In reply to Tracking NT users within ...

Didn't meet the criteria

Collapse -

Tracking NT users within Exchange

by nsa13 In reply to Tracking NT users within ...

This question was closed by the author

Back to Software Forum
5 total posts (Page 1 of 1)  

Related Discussions

Related Forums