Inbox Access Tracking

[NetworkGuy101]

I would like to be able to find out if people are snooping in others inboxs I have setup logging and am filtering event id 1016 but It will generate this even if you just view others calender. Is there a way to track the inbox and not the hwole mailbox?

 

[Marcs41]

If you are in doubt people are snooping, your FIRST check should be security. Put your time and effort in that, not finding the ones snooping.
If it is happening, you should start wondering WHY it can happen, and if you are in charge of the Exchange Server, your first place to start is the rights everyone has.
If there are to many rights given, then sorry, but the blame rests on the Exchange Admin.

Marc
_{If 'something' 'somewhere' gives 'some' error, expect random guesses or no replies at all.
Free Tip: The F1 Key does NOT destroy your PC!}
Have a look at the shop @

http://www.cafepress.com/tektips

!

 

[NetworkGuy101]

Well I know why it is happening because someone with the appropriate rights may be abusing those rights. The problem is proving it. I am not in a postion where I can take those rights away but if I can prove bad ethics I can at least manage to save the privacy of those individuals that may be getting violated.

 

[Marcs41]

If you have, as you state, access to the Eventlogs, you make a 'deal' with the mailbox owner to stay off mail for a while, or to only access it at certain preset times. Any other access in between is, at least, fishy.
If you have access to the 'abuser's' PC, and he/she is using Outlook to access the mailbox, it may still be in there in File - Open ....

Marc
_{If 'something' 'somewhere' gives 'some' error, expect random guesses or no replies at all.
Free Tip: The F1 Key does NOT destroy your PC!}
Have a look at the shop @

http://www.cafepress.com/tektips

!

 

[NetworkGuy101]

Yes but I want to have solid proof. If the individual says that they were just accessing a calender or such then it wouldnt be a big deal. I would hate to bring and cause problems but I would hate to ignore it.

 

[Marcs41]

You got to ask yourself 'Am I sure', because at some point your only option will be to resort to your own snooping, which is what you blame the other.
Why is he/she doing that, and, can you not have a 'normal' talk about it with that person?

As for the sharing, if you can, un-share the Calendar, so it cannot be used as excuse.

Marc
_{If 'something' 'somewhere' gives 'some' error, expect random guesses or no replies at all.
Free Tip: The F1 Key does NOT destroy your PC!}
Have a look at the shop @

http://www.cafepress.com/tektips

!