Solved

Exchange Server unauthorized access attempt

Posted on 2003-11-24
3
542 Views
Last Modified: 2008-03-10
My Exchange administrator forwarded this event log message to me today. I am concerned about what it means -exactly- and also if it could occur (the event) inadvertently. I don't want to accuse anyone of wrongdoing, but I need to be prudent and take appropriate action. Please advise.

Date/Time: 2003-11-24 09:44:56'00

Event Log: Application
Type:      Warning
Source:    MSExchangeIS Mailbox Store
Category:  Access Control
Event:     -2146565115

Message:

Firstname.lastname@ourcompany.com failed an operation because the user did not have the following access rights:

'Delete' 'Read Property' 'Write Property' 'Create Message' 'View Item' 'Create Subfolder' 'Write Security Descriptor' 'Write Owner' 'Read Security Descriptor' 'Contact'


The distinguished name of the owning mailbox is
/O=Our Compnay Name/OU=FIRST ADMINISTRATIVE GROUP/CN=RECIPIENTS/CN=My.mailbox.
 The folder ID is in the data section of this event.
0
Comment
Question by:bajensen01
3 Comments
 
LVL 26

Assisted Solution

by:Vahik
Vahik earned 250 total points
ID: 9815371
well what is it u want us to tell u?That some one was trying to access ur mailbox and he had no rights.Well that is what it looks like.Was this an accident ?that is for u to decide.Did this action happen?i think u could say with %99  accuracy that it did happen.I have never been a judge or a jurry.U must draw ur own conclusion.Besides why did u hire an exchange admin for anyways.
0
 

Author Comment

by:bajensen01
ID: 9819989
Vahik,
Yes I did hire an EA to watch over things like this, but there are times when you need to watch the watchers... What I was looking for was a plausible scenario where this event might occur AND NOT be a blatant attempt at unauthorized access. If I read your comment correctly, you are saying that with a 99% degree of assurance, this WAS an unauthorized attempt to gain access to my mailbox.

Thanks for your response.
0
 
LVL 1

Accepted Solution

by:
ahgates earned 250 total points
ID: 9820443
These could be attempts from an assistant to access their bosses mailbox(To answer email for them) or attempts from users to access the managers calendar(to enter their vacation as instructed) all with the okay from the boss or manager that just hasn't setup their folder permissions properly.

I would require the issue be investigated by your Exchange Admin.

I personally would only be bothered by this type of error if it was:
1. Extreme High Security enviroment
2. An Admin mailbox was involved
3. A VIP's Mailbox was involved
The access failures also would have to be repeating.

If I was losing sleep over it and did not trust my Exhange Admin the only real answer is to get a security specialist to come in for an afternoon. But if you dont trust your Exchange Admin who can you trust?
0

Featured Post

Announcing the Most Valuable Experts of 2016

MVEs are more concerned with the satisfaction of those they help than with the considerable points they can earn. They are the types of people you feel privileged to call colleagues. Join us in honoring this amazing group of Experts.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Utilizing an array to gracefully append to a list of EmailAddresses
We are happy to announce a brand new addition to our line of acclaimed email signature management products – CodeTwo Email Signatures for Office 365.
In this video we show how to create a Distribution Group in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >>…
In this video we show how to create a Contact in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Contact ta…

733 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question