Monitoring mailbox access in EX5.5

This a familiar standard message you find in the Eventviewer when users are give access to any object in other user's mailbox. For example, read only access to calendar etc. It does not necessarility menat the the user has access to every object in the other user's mailbox.

The best way to test this is to give a user read only permission to another's calendar, goto tools, services tab, click on properties button, in the advanced tab click the add button to add additional mailboes.

Once this is done go to Outlook and you should find addional mailbox of the other user show read only access to the calendar.

Its difficult to audit (I had a similar need), the only way I could think around it was disable the default Admin account and then to give all of my Administrators specific admin accounts that were unique to them - and instructed them to keep the details private.

This way I could tell the different in the logs.

Let's make sure I understand your situation: you have an Exchange administrator in your organization that you suspect of opening mailboxes for something other than legit purposes? If this is correct, it is a sticky problem.

As you already know, event 1016 doesn't necessarily mean a mailbox was opened for anything other than legit purposes. You can turn diagnostics to maximum for Logons and Access Control and this will give you a bit more info, but probably not enough to be sure (and you want to be very sure, of course). And an Admin who has access to everything could easily wipe out any logs to cover up.

If possible, consider limiting the number of people who have the Service account password and limit your Admins roles as much as you can without hurting their legit functionality. For example, just as everyone need not have the Service account password, not everyone needs Service Account Admin or Permissions Admin privileges. Assign most people Admin role only, so they can't open other's mailboxes. I know, it's handy at times for legit troubleshooting but still not really needed. If this isn't possible, or the suspect is your senior admin and has access to the world, I'm afraid there's little more you can do. You could keep track of the 1016 his/her account generates and then see what legit business they had at the time, but again not likely to nail it.