Avatar of jmahlmann
 asked on

need to trace a user on sbs 2008

We have a user that we believe is doing something malicious. Anyone help with software or MS tools that can help track what the user is doing? I don't want to track the computer as they can access more than one computer.
CiscoSBSWindows Server 2008

Avatar of undefined
Last Comment

8/22/2022 - Mon
Manpreet SIngh Khatra

What tracking you want to do ? MessageTracking ? Copy of all emails ? What is the MailboxDatabase size as for it you can enable Journaling and any mailbox sending\receiving anything would be recorded and email to this mailbox

Are you want to check sending\receiving

- Rancy

We want to trace what they do. We are afraid they are going in and deleting docs, changing docs. Same with emails.
Manpreet SIngh Khatra

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question

Okay they now just want to trace the exchange email and see if they delete anything in their mail boxes. I set up the exchange auditing, but I can't see if they delete anything from their email??

I configured folder access, message access, etc...

Also, I can sort by user name? When I add the field user it show n/a even though it has username info in the event logs?
Experts Exchange has (a) saved my job multiple times, (b) saved me hours, days, and even weeks of work, and often (c) makes me look like a superhero! This place is MAGIC!
Walt Forbes