Exchange 2007 track connected clients

Hello,

I have a user that constantly complains from missing emails (he uses deleted items folder for storing emails, which is complete nightmare). However I am sure that one of the devices he uses does this. I know that he has two mobile devices and one iPad. In the office in use is Outlook 2007. How can I track if any other device is connecting to his mailbox, and deleting this emails?

The configuration is SBS 2008 and exchange 2007.
goliveukAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Patrick BogersDatacenter platform engineer LindowsCommented:
Hi

This is total nightmare to find out,

My best guess is a device is configured to use POP3 now which is easily able to delete mail from the server once collected.
You can ask him which device does have the missing mail. a tip for you, let them use IMAP in the future om BYODs.

BTW: you can check IIS logs which will show which user is logging in with which user agent to give you a clue.
0
Will SzymkowskiSenior Solution ArchitectCommented:
You will be able to track connection status viewing the ActiveSync Logs in IIS. However you will not be able to find out where the email has been removed from.

If you are looking for specific auditing in your Exchange environment i would suggest using Exchange Auditor by Lepide software.
http://www.lepide.com/lepideauditor/exchange.html

Will.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Adam ConnollyCommented:
Easiest thing would probably be to change his password on his AD account.  That should break whatever other devices may be connecting to it.  The problem that will come with that might be that his account locks out.  You should be able to track that down with this software.  Has some good guides on how to enable auditing to find more information on the device attempting to connect.

http://www.netwrix.com/account_lockout_examiner.html
0
goliveukAuthor Commented:
Will Szymkowski, will that Exchange Auditor show the connections from email clients such as Outlook, Mac Email clients and so on?
0
goliveukAuthor Commented:
However, I mirrored all his emails to another mailbox
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.