How can I determine if a user in Outlook accessed a particular Shared Inbox?

Posted on 2009-12-28
Last Modified: 2012-05-08
Is there a way to determine by analyzing files on an end user's machine if a particular shared inbox in Exchange was opened via their Outlook client?  The Exchange server provided by our vendor does not offer any access logs for us to review, and we want to find out if a user accessed a particular Inbox of another user.  We found that the user had access to the inbox and was not authorized.  The permissions have since been updated but we are trying to review the extent of the damage.

Question by:gtoaster
    LVL 65

    Expert Comment

    There is nothing on the workstation that will log things.
    The server does log access to other mailboxes.

    LVL 6

    Accepted Solution

    In C:\Documents and Settings\<user login name>\Application Data\Microsoft\Outlook
    There will be files named:

    I do not think this will be very conclusive because
    1- It does not tell you what has been changed
    2- You can name a profile whatever you like (i.e. I can log in to boss's mailbox and use janitor's name as profile)
    3- The bad guy might have used OWA

    Another longshot, If the 'bad guy' happened to open Outlook in cache mode there will be files in:
    C:\Documents and Settings\<user login name>\Local Settings\Application Data\Microsoft\Outlook

    Featured Post

    Shouldn't all users have the same email signature?

    You wouldn't let your users design their own business cards, would you? So, why do you let them design their own email signatures? Think of the damage they could be doing to your brand reputation! Choose the easy way to manage set up and add email signatures for all users.

    Join & Write a Comment

    Suggested Solutions

    Granting full access permission allows users to access mailboxes present in their database. By giving full access permission one can open and read the content of any mailbox but cannot send emails from that mailbox.
    "Migrate" an SMTP relay receive connector to a new server using info from an old server.
    In this video we show how to create a Contact in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Contact ta…
    The basic steps you have just learned will be implemented in this video. The basic steps are shown to configure an Exchange DAG in a live working Exchange Server Environment and manage the same (Exchange Server 2010 Software is used in a Windows Ser…

    730 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    18 Experts available now in Live!

    Get 1:1 Help Now