Get stats of employee email usage via PS who is using an iPad
We have an employee who has taken unapproved leave and taken her company issued iPad tablet with her.
The Dept head has a strong suspicion that the employee is using the tablet in ways that are a concern.
What sorts of usage information can be obtained in Exchange 2016 via Powershell for things like dates/times of emails being read, emails being sent.
Because the device isnt using Activiesync (being an Apple) I suspect the stats PS provides about ActiveSyn transactions wont be any value.
The Dept head has a strong suspicion that the employee is using the tablet in ways that are a concern.
What sorts of usage information can be obtained in Exchange 2016 via Powershell for things like dates/times of emails being read, emails being sent.
Because the device isnt using Activiesync (being an Apple) I suspect the stats PS provides about ActiveSyn transactions wont be any value.
Being that this is a company issued device you can send a wipe command.
Do you had a MDM solution in place? If so you most likely lock and wipe as well.
If not you can try using the clear-acticesyncdevice.
https://docs.microsoft.com/en-us/powershell/module/exchange/devices/clear-activesyncdevice?view=exchange-ps
Do you had a MDM solution in place? If so you most likely lock and wipe as well.
If not you can try using the clear-acticesyncdevice.
https://docs.microsoft.com/en-us/powershell/module/exchange/devices/clear-activesyncdevice?view=exchange-ps
ASKER
Thanks to all, but the issue is we need to have stats on the usage of the device since the employee left.
Being an ipad the device doesnt use activesync, so these stats arent of any value.
We can wipe the device but we are gathering information about the employees behaviour, and hence want the stats surrounding emails sent, read and when these took place.
Being an ipad the device doesnt use activesync, so these stats arent of any value.
We can wipe the device but we are gathering information about the employees behaviour, and hence want the stats surrounding emails sent, read and when these took place.
I misread. I thought you have ActiveSync. Without any direct connection to your systems I am not sure if you have any options.
Are you an admin to your exchange. You can give yourself full access to her email and look via Outlook at the modified date column.
If she left like you described why not just shut her account down.
If she left like you described why not just shut her account down.
ASKER
I can get stats via the Get-MessageTrackingLog -Sender ASmith@ourcompany.com but I cant clarify which are sent from say OLK and which are sent from the iPad messaging app. and can get a list of emails sent and received but its the ones that are read from a specific device that I want.
There is "read" data retained for different clients of a mailbox, just can figure out how to get at it.
There is "read" data retained for different clients of a mailbox, just can figure out how to get at it.
That info you will most likely never get or successfully correlate. Now the question that comes to mind, How would this user send something from this iPAD if they do not have an ActiveSync setup on it? Secondly if this user left is the manor you stated why would she be sending email from this account.
Because the device isnt using Activiesync (being an Apple) I suspect the stats PS provides about ActiveSync transactions wont be any value.
ASKER
Hi Yo_bee,
The tablet uses the same HTTPS connection as OLK Anywhere.
I have been able to get transaction histories showing the user is fwding emails to an external mailbox and communicating with prohibited 3rd parties.
Without going into too much detail the task is part of an investigation.
The tablet uses the same HTTPS connection as OLK Anywhere.
I have been able to get transaction histories showing the user is fwding emails to an external mailbox and communicating with prohibited 3rd parties.
Without going into too much detail the task is part of an investigation.
I would lock her account ASAP as she seems to be in violation with your company policy
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
This will give you last sync time stamp. This is in UCT time.