Pau Lo
asked on
viewing email via delegates
A user has been granted delegate rights via outlook 2003. They have been viewing email they shouldnt (should not have had delegate rights). On an XP machine would there be anyway to see evidence they viewed this email on their PC? If so any pointers on where?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
And where is the security event log? Is this the OS event log?
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
OST was just an educated guess - i have never tried that myself
it will be on one of the Domain controllers, even if they haven't had to manually add it outlook opens it then there should be a logon event
it will be on one of the Domain controllers, even if they haven't had to manually add it outlook opens it then there should be a logon event
ASKER
>>they might have been silly to leave the outlook mailbox connection in there outlook profile
How can you check the above?
How can you check the above?
ASKER
>>You need to enabled Mailbox Logging to Maximum to have it in Event Viewer.
We didnt.
We didnt.
the only way you can check that it by logging onto the clients PC as them and see what is connected in outlook.
the mailbox logons it the best path to start the investigation off
the mailbox logons it the best path to start the investigation off
ASKER
Where is the "mailbox logons path" can you detail it in outlook 2003? In laymans terms.
sorry that wasn't very clear. The best way to start investigating this is to enable the logging in Exchange and then use that to see if they are logging onto the mailboxes
ASKER
Ah ok - not to much use though after the event I guess.
no there is not a lot you can do retroactively
Here's the detailed steps on how to get to there. (my suggestion above)
Exchange Diagnostics Logging
http://www.msexchange.org/tutorials/Importance-Auditing-Exchange-2003-Servers.html
Exchange Diagnostics Logging
http://www.msexchange.org/tutorials/Importance-Auditing-Exchange-2003-Servers.html
ASKER
And what if they dont use an OST? OST isnt mandatory is it?