Windows Forum

Ask something
Discussion Locked

exchange archiving files

0 helpful
5 replies

by tec

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Where does exchange normally store the file that contains the information that it stores when you turn archive logging on maximum?

I have a software package that monitors exchagne by reviewing these logs to determine if users are using profanity and jokes. I am looking for software that will strip executables from users e-mail if anyone has seen such software.

5 replies

by vshipp

There are several answers to your question depending on your environment.
Assuming NT4 / EXCHANGE 5.5 / OUTLOOK CLIENT
Scenario, the default for a users archive of *.pst files (Users have the permission to use any path network or local) would be in their local profile (C:\winnt\profiles\%username%\local settings\application Data\microsoft\Outlook) This only applies if they have not played with the path.
It will create a generic file called archive.pst (unless, they have played with the file name). Having said that, these files get thrown around like they have come out of a fertilizer spreader and are almost impossible to nail down.
If a number of users log on to the same machine, there can be several *.pst files locally and you can nottell which *.pst belongs to who. What you should consider is implementing domain policy to force these paths and filenames. Haaverson has an excellent tool called OProfile for doing this in conjunction with regular NT Poledit.exe and the proper *.adm files.
(**NOTE DOM

This discussion is closed to new replies.