troubleshooting Question

Audit Exchange Administrator Login

Avatar of CIPortAuthority
CIPortAuthority asked on
Exchange
9 Comments1 Solution480 ViewsLast Modified:
We are running Exchange Server 2003 SP2.  While doing some cleanup of the mailboxes, I noticed that 99% of our user's mailboxes have a last logged in as <DOMAIN>\Administrator.  I am not concerned that someone is using the Administrator account to look at peoples mailboxes but I am concerned that there is some process that accesses Exchange that is running as the Administrator account.  I am trying to find out which machine this service might be running on.  I turned on maximum diagnostic logging for mailbox logons and access control and I can see a number of 1016 and 1009 events but this only tells me that the Administrator is logging in and not from where.

How can I find out where the Administrator account is being used?
Join the community to see this answer!
Join our exclusive community to see this answer & millions of others.
Unlock 1 Answer and 9 Comments.
Join the Community
Learn from the best

Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.

Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 1 Answer and 9 Comments.
Try for 7 days

”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.

-Mike Kapnisakis, Warner Bros