Solved

Exchange Server unauthorized access attempt

Posted on 2003-11-24
3
526 Views
Last Modified: 2008-03-10
My Exchange administrator forwarded this event log message to me today. I am concerned about what it means -exactly- and also if it could occur (the event) inadvertently. I don't want to accuse anyone of wrongdoing, but I need to be prudent and take appropriate action. Please advise.

Date/Time: 2003-11-24 09:44:56'00

Event Log: Application
Type:      Warning
Source:    MSExchangeIS Mailbox Store
Category:  Access Control
Event:     -2146565115

Message:

Firstname.lastname@ourcompany.com failed an operation because the user did not have the following access rights:

'Delete' 'Read Property' 'Write Property' 'Create Message' 'View Item' 'Create Subfolder' 'Write Security Descriptor' 'Write Owner' 'Read Security Descriptor' 'Contact'


The distinguished name of the owning mailbox is
/O=Our Compnay Name/OU=FIRST ADMINISTRATIVE GROUP/CN=RECIPIENTS/CN=My.mailbox.
 The folder ID is in the data section of this event.
0
Comment
Question by:bajensen01
3 Comments
 
LVL 26

Assisted Solution

by:Vahik
Vahik earned 250 total points
ID: 9815371
well what is it u want us to tell u?That some one was trying to access ur mailbox and he had no rights.Well that is what it looks like.Was this an accident ?that is for u to decide.Did this action happen?i think u could say with %99  accuracy that it did happen.I have never been a judge or a jurry.U must draw ur own conclusion.Besides why did u hire an exchange admin for anyways.
0
 

Author Comment

by:bajensen01
ID: 9819989
Vahik,
Yes I did hire an EA to watch over things like this, but there are times when you need to watch the watchers... What I was looking for was a plausible scenario where this event might occur AND NOT be a blatant attempt at unauthorized access. If I read your comment correctly, you are saying that with a 99% degree of assurance, this WAS an unauthorized attempt to gain access to my mailbox.

Thanks for your response.
0
 
LVL 1

Accepted Solution

by:
ahgates earned 250 total points
ID: 9820443
These could be attempts from an assistant to access their bosses mailbox(To answer email for them) or attempts from users to access the managers calendar(to enter their vacation as instructed) all with the okay from the boss or manager that just hasn't setup their folder permissions properly.

I would require the issue be investigated by your Exchange Admin.

I personally would only be bothered by this type of error if it was:
1. Extreme High Security enviroment
2. An Admin mailbox was involved
3. A VIP's Mailbox was involved
The access failures also would have to be repeating.

If I was losing sleep over it and did not trust my Exhange Admin the only real answer is to get a security specialist to come in for an afternoon. But if you dont trust your Exchange Admin who can you trust?
0

Featured Post

Optimizing Cloud Backup for Low Bandwidth

With cloud storage prices going down a growing number of SMBs start to use it for backup storage. Unfortunately, business data volume rarely fits the average Internet speed. This article provides an overview of main Internet speed challenges and reveals backup best practices.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Read this checklist to learn more about the 15 things you should never include in an email signature.
This article aims to explain the working of CircularLogArchiver. This tool was designed to solve the buildup of log file in cases where systems do not support circular logging or where circular logging is not enabled
In this video we show how to create an Address List in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Organization >> Ad…
In this video we show how to create an email address policy in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Mail Flow…

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question