Exchange Server unauthorized access attempt

My Exchange administrator forwarded this event log message to me today. I am concerned about what it means -exactly- and also if it could occur (the event) inadvertently. I don't want to accuse anyone of wrongdoing, but I need to be prudent and take appropriate action. Please advise.

Date/Time: 2003-11-24 09:44:56'00

Event Log: Application
Type:      Warning
Source:    MSExchangeIS Mailbox Store
Category:  Access Control
Event:     -2146565115

Message:

Firstname.lastname@ourcompany.com failed an operation because the user did not have the following access rights:

'Delete' 'Read Property' 'Write Property' 'Create Message' 'View Item' 'Create Subfolder' 'Write Security Descriptor' 'Write Owner' 'Read Security Descriptor' 'Contact'


The distinguished name of the owning mailbox is
/O=Our Compnay Name/OU=FIRST ADMINISTRATIVE GROUP/CN=RECIPIENTS/CN=My.mailbox.
 The folder ID is in the data section of this event.
bajensen01Systems EngineerAsked:
Who is Participating?
 
ahgatesCommented:
These could be attempts from an assistant to access their bosses mailbox(To answer email for them) or attempts from users to access the managers calendar(to enter their vacation as instructed) all with the okay from the boss or manager that just hasn't setup their folder permissions properly.

I would require the issue be investigated by your Exchange Admin.

I personally would only be bothered by this type of error if it was:
1. Extreme High Security enviroment
2. An Admin mailbox was involved
3. A VIP's Mailbox was involved
The access failures also would have to be repeating.

If I was losing sleep over it and did not trust my Exhange Admin the only real answer is to get a security specialist to come in for an afternoon. But if you dont trust your Exchange Admin who can you trust?
0
 
VahikCommented:
well what is it u want us to tell u?That some one was trying to access ur mailbox and he had no rights.Well that is what it looks like.Was this an accident ?that is for u to decide.Did this action happen?i think u could say with %99  accuracy that it did happen.I have never been a judge or a jurry.U must draw ur own conclusion.Besides why did u hire an exchange admin for anyways.
0
 
bajensen01Systems EngineerAuthor Commented:
Vahik,
Yes I did hire an EA to watch over things like this, but there are times when you need to watch the watchers... What I was looking for was a plausible scenario where this event might occur AND NOT be a blatant attempt at unauthorized access. If I read your comment correctly, you are saying that with a 99% degree of assurance, this WAS an unauthorized attempt to gain access to my mailbox.

Thanks for your response.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.