Investigate activity of on an Exchange 03 mailbox

hi, i need to check an exchange account used with outlook client to see if the user has forwarded emails to a personal email address and generally look into the activity on this specific mailbox - how can i go about this?  thanks, tony
tokeeAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Mike ThomasConsultantCommented:
The only way i can think of nativly is to use message tracking to see where the user has been sending, if you know the email address of the external account this would make things easier when searching.

You could also access the users mailbox and check their sent items deleted items but there is a chance they have been deleted and purged.
0
Glen KnightCommented:
In Active Directory Users and Computers right click the user and select properties, under Exchange Advanced click Mailbox Rights and add yourself in with FULL ACCESS.

Obviously you need to obide by your companies policies but this is how you would do it.

You may also find that if they employee does not know you are monitoring their system (communications policy or some sort advising them of this) then you could be breaking the law.
0
marcokrecicCommented:
look at this http://www.msexchange.org/tutorials/Exchange_Server_2003_Message_Flow.html

this site is a great resource for MS Exchange.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
The Ultimate Tool Kit for Technolgy Solution Provi

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy for valuable how-to assets including sample agreements, checklists, flowcharts, and more!

Premkumar YogeswaranAnalyst II - System AdministratorCommented:
Check this link:
http://www.petri.co.il/enable_journaling_in_exchange.htm

Journalling is a best way for this..!
0
Glen KnightCommented:
Journalling is NOT going to tell you if it has ALREADY been done!  It will only help for messages sent AFTER journalling has been enabled.
0
Premkumar YogeswaranAnalyst II - System AdministratorCommented:
Ok...!
As Demazter mentioned in 28669279 you can access the mailbox but if the mail is deleted. How it could be viewed.

But if you want to find the to field you can use  Message Tracking center
hope it should have enabled already.

check this link for message tracking
http://www.msexchange.org/tutorials/Exchange-2003-Message-Tracking-Logging.html
http://www.computerperformance.co.uk/exchange2003/exchange2003_message_tracking.htm

But in this case to we can only see the mail but not the content.

From this you can verify if the mail has deleted from viewing the end user's mailbox.
0
Glen KnightCommented:
Message tracking is not enabled by default premglitz, so unless it has been turned on (which is unlikely) it's not going to help.
0
Premkumar YogeswaranAnalyst II - System AdministratorCommented:
Yep.. i agree with you Demazter.

Hi Tokee,
Can you confirm have you enabled the Messaging Tracking in your Org.?
For that you can refer link in my post above.
0
tokeeAuthor Commented:
hi all, thanks for the suggestions.  yes, message tracking is on so i'm investigating that avenue at the moment and the email retention period is set to the max so i can retrieve some deleted email.  the person in question is no longer an employee and we have stipulated in our employee handbook that email remains the property of our company (or something to that effect) so no problem there.  i'm going to take some time to go through your suggestions and will come back shortly.  thanks again.  i don't suppose there's any record of what was deleted and when retained on exch server?
0
tokeeAuthor Commented:
Thanks for your suggestions, none of them answered my specific question but they were of assistance...
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.