Get stats of employee email usage via PS who is using an iPad

We have an employee who has taken unapproved leave and taken her company issued iPad tablet with her.

The Dept head has a strong suspicion that the employee is using the tablet in ways that are a concern.

What sorts of usage information can be obtained in Exchange 2016 via Powershell for things like dates/times of emails being read, emails being sent.

Because the device isnt using Activiesync (being an Apple) I suspect the stats PS provides about ActiveSyn transactions wont be any value.
LVL 8
mbkitmgrAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

yo_beeDirector of Information TechnologyCommented:
Using Get-ActiveSyncStatistics -mailbox   Username

This will give you last sync time stamp. This is in UCT time.
yo_beeDirector of Information TechnologyCommented:
Being that this is a company issued device you can send a wipe command.

Do you had a MDM solution in place? If so you most likely lock and wipe as well.

If not you can try using the clear-acticesyncdevice.


https://docs.microsoft.com/en-us/powershell/module/exchange/devices/clear-activesyncdevice?view=exchange-ps
mbkitmgrAuthor Commented:
Thanks to all, but the issue is we need to have stats on the usage of the device since the employee left.

Being an ipad the device doesnt use activesync, so these stats arent of any value.
We can wipe the device but we are gathering information about the employees behaviour, and hence want the stats surrounding emails sent, read and when these took place.
Big Business Goals? Which KPIs Will Help You

The most successful MSPs rely on metrics – known as key performance indicators (KPIs) – for making informed decisions that help their businesses thrive, rather than just survive. This eBook provides an overview of the most important KPIs used by top MSPs.

yo_beeDirector of Information TechnologyCommented:
I misread. I thought you have ActiveSync.   Without any direct connection to your systems I am not sure if you have any options.
yo_beeDirector of Information TechnologyCommented:
Are you an admin to your exchange. You can give yourself full access to her email and look via Outlook at the modified date column.

If she left like you described why not just shut her account down.
mbkitmgrAuthor Commented:
I can get stats via the Get-MessageTrackingLog -Sender ASmith@ourcompany.com but I cant clarify which are sent from say OLK and which are sent from the iPad messaging app. and can get a list of emails sent and received but its the ones that are read from a specific device that I want.

There is "read" data retained for different clients of a mailbox, just can figure out how to get at it.
yo_beeDirector of Information TechnologyCommented:
That info you will most likely never get or successfully correlate.  Now the question that comes to mind, How would this user send something from this iPAD if they do not have an ActiveSync setup on it?  Secondly if this user left is the manor you stated why would she be sending email from this account.  

Because the device isnt using Activiesync (being an Apple) I suspect the stats PS provides about ActiveSync transactions wont be any value.
mbkitmgrAuthor Commented:
Hi Yo_bee,

The tablet uses the same HTTPS connection as OLK Anywhere.

I have been able to get transaction histories showing the user is fwding emails to an external mailbox and communicating with prohibited 3rd parties.  

Without going into too much detail the task is part of an investigation.
yo_beeDirector of Information TechnologyCommented:
I would lock her account ASAP as she seems to be in violation with your company policy
mbkitmgrAuthor Commented:
While I havent been able to find the specific data we needed to know what emails were being read.

We have instead gone down tghe patch of
  • Executing PS queries on the transaction logs
  • Using these to identify usage patterns of the individual
  • While "meesage was read @" would be better
  • Data showing the behaviour of the user is sufficient.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Powershell

From novice to tech pro — start learning today.