Event ID: 1029 and shared mailboxes 1

[BobSheridan]

This doesn't appear to have affected any of our users, nobody has complained yet, but I still would like to find out what it means.

We are getting a warning in our Event Log on our Exchange server. I've taken a look on the microsoft website to find out what it means, and couldn't find anything, so I thought I would try here next.

Here are the details of the error:

Source: MSExchangeIS Mailbox
Category: Access Control
Event ID: 1029

User1@domain failed an operation because the user did not have the following access rights:

'Delete' 'Read Property' 'Write Property' 'Create Message' 'View Item' 'Create Subfolder' 'Write Security Descriptor' 'Write Owner' 'Read Security Descriptor' 'Contact'

The distinguished name of the owning mailbox is <user2 set up to allow user1 access to their mailbox>. The Folder ID is in the data section of this event.

The link to the microsoft website at the bottom of the event properties leads to a "this page doesn't exist" page.

Can anyone shed any light onto what this means for me? It is occuring to several other user/shared mailbox combinations, but not all user/shared mailbox combinations. (A lot of our users have shared mailboxes set up.)

Thanks for any help that you can provide.

 

[xmsre]

It's an audit entry. It means that user1 tried to access a folder in user2's mailbox . Typically this happens when someone reads an item that is not a message. The public folder equivalent is an event ID 1030. It's documented:

http://support.microsoft.com/default.aspx?scid=kb;en-us;325885

 

[BobSheridan]

Thanks xmsre,

Ahh, that makes sense. I couldn't understand how all those errors were being generated without anybody complaining.

Thanks again for your help,

Bob