Get stats of employee email usage via PS who is using an iPad

mbkitmgr
mbkitmgr used Ask the Experts™
on
We have an employee who has taken unapproved leave and taken her company issued iPad tablet with her.

The Dept head has a strong suspicion that the employee is using the tablet in ways that are a concern.

What sorts of usage information can be obtained in Exchange 2016 via Powershell for things like dates/times of emails being read, emails being sent.

Because the device isnt using Activiesync (being an Apple) I suspect the stats PS provides about ActiveSyn transactions wont be any value.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
yo_beeDirector of Information Technology

Commented:
Using Get-ActiveSyncStatistics -mailbox   Username

This will give you last sync time stamp. This is in UCT time.
yo_beeDirector of Information Technology

Commented:
Being that this is a company issued device you can send a wipe command.

Do you had a MDM solution in place? If so you most likely lock and wipe as well.

If not you can try using the clear-acticesyncdevice.


https://docs.microsoft.com/en-us/powershell/module/exchange/devices/clear-activesyncdevice?view=exchange-ps

Author

Commented:
Thanks to all, but the issue is we need to have stats on the usage of the device since the employee left.

Being an ipad the device doesnt use activesync, so these stats arent of any value.
We can wipe the device but we are gathering information about the employees behaviour, and hence want the stats surrounding emails sent, read and when these took place.
Ensure you’re charging the right price for your IT

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

yo_beeDirector of Information Technology

Commented:
I misread. I thought you have ActiveSync.   Without any direct connection to your systems I am not sure if you have any options.
yo_beeDirector of Information Technology

Commented:
Are you an admin to your exchange. You can give yourself full access to her email and look via Outlook at the modified date column.

If she left like you described why not just shut her account down.

Author

Commented:
I can get stats via the Get-MessageTrackingLog -Sender ASmith@ourcompany.com but I cant clarify which are sent from say OLK and which are sent from the iPad messaging app. and can get a list of emails sent and received but its the ones that are read from a specific device that I want.

There is "read" data retained for different clients of a mailbox, just can figure out how to get at it.
yo_beeDirector of Information Technology

Commented:
That info you will most likely never get or successfully correlate.  Now the question that comes to mind, How would this user send something from this iPAD if they do not have an ActiveSync setup on it?  Secondly if this user left is the manor you stated why would she be sending email from this account.  

Because the device isnt using Activiesync (being an Apple) I suspect the stats PS provides about ActiveSync transactions wont be any value.

Author

Commented:
Hi Yo_bee,

The tablet uses the same HTTPS connection as OLK Anywhere.

I have been able to get transaction histories showing the user is fwding emails to an external mailbox and communicating with prohibited 3rd parties.  

Without going into too much detail the task is part of an investigation.
yo_beeDirector of Information Technology

Commented:
I would lock her account ASAP as she seems to be in violation with your company policy
Commented:
While I havent been able to find the specific data we needed to know what emails were being read.

We have instead gone down tghe patch of
  • Executing PS queries on the transaction logs
  • Using these to identify usage patterns of the individual
  • While "meesage was read @" would be better
  • Data showing the behaviour of the user is sufficient.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial