Solved

Exchange Server unauthorized access attempt

Posted on 2003-11-24
3
520 Views
Last Modified: 2008-03-10
My Exchange administrator forwarded this event log message to me today. I am concerned about what it means -exactly- and also if it could occur (the event) inadvertently. I don't want to accuse anyone of wrongdoing, but I need to be prudent and take appropriate action. Please advise.

Date/Time: 2003-11-24 09:44:56'00

Event Log: Application
Type:      Warning
Source:    MSExchangeIS Mailbox Store
Category:  Access Control
Event:     -2146565115

Message:

Firstname.lastname@ourcompany.com failed an operation because the user did not have the following access rights:

'Delete' 'Read Property' 'Write Property' 'Create Message' 'View Item' 'Create Subfolder' 'Write Security Descriptor' 'Write Owner' 'Read Security Descriptor' 'Contact'


The distinguished name of the owning mailbox is
/O=Our Compnay Name/OU=FIRST ADMINISTRATIVE GROUP/CN=RECIPIENTS/CN=My.mailbox.
 The folder ID is in the data section of this event.
0
Comment
Question by:bajensen01
3 Comments
 
LVL 26

Assisted Solution

by:Vahik
Vahik earned 250 total points
ID: 9815371
well what is it u want us to tell u?That some one was trying to access ur mailbox and he had no rights.Well that is what it looks like.Was this an accident ?that is for u to decide.Did this action happen?i think u could say with %99  accuracy that it did happen.I have never been a judge or a jurry.U must draw ur own conclusion.Besides why did u hire an exchange admin for anyways.
0
 

Author Comment

by:bajensen01
ID: 9819989
Vahik,
Yes I did hire an EA to watch over things like this, but there are times when you need to watch the watchers... What I was looking for was a plausible scenario where this event might occur AND NOT be a blatant attempt at unauthorized access. If I read your comment correctly, you are saying that with a 99% degree of assurance, this WAS an unauthorized attempt to gain access to my mailbox.

Thanks for your response.
0
 
LVL 1

Accepted Solution

by:
ahgates earned 250 total points
ID: 9820443
These could be attempts from an assistant to access their bosses mailbox(To answer email for them) or attempts from users to access the managers calendar(to enter their vacation as instructed) all with the okay from the boss or manager that just hasn't setup their folder permissions properly.

I would require the issue be investigated by your Exchange Admin.

I personally would only be bothered by this type of error if it was:
1. Extreme High Security enviroment
2. An Admin mailbox was involved
3. A VIP's Mailbox was involved
The access failures also would have to be repeating.

If I was losing sleep over it and did not trust my Exhange Admin the only real answer is to get a security specialist to come in for an afternoon. But if you dont trust your Exchange Admin who can you trust?
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Scam emails are a huge burden for many businesses. Spotting one is not always easy. Follow our tips to identify if an email you receive is a scam.
Find out what you should include to make the best professional email signature for your organization.
The video tutorial explains the basics of the Exchange server Database Availability groups. The components of this video include: 1. Automatic Failover 2. Failover Clustering 3. Active Manager
This video demonstrates how to sync Microsoft Exchange Public Folders with smartphones using CodeTwo Exchange Sync and Exchange ActiveSync. To learn more about CodeTwo Exchange Sync and download the free trial, go to: http://www.codetwo.com/excha…

920 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now