Clicky

i have one requirement from my management and they want to track if anyone access anybody mailbox by taking permission on their mailbox (example admin person)

how to track if any adminstrator access any management user mailbox by taking permission on user mailbox

asked 07/18/2011 08:28

ManojBojewar's gravatar image

ManojBojewar ♦♦


10 Answers:
any response
link

answered

ManojBojewar's gravatar image

ManojBojewar

Exchange2007 sp1
link

answered 2011-07-20 at 03:20:41

ManojBojewar's gravatar image

ManojBojewar

you need to enable auditing against mailbox access on your Exchange 2007.

one of the new features that service pack 2 of Exchange 2007 server brings is the ability to audit mailbox access, though mailbox access logging is not a new concept for Exchange.

FYI

Mailbox Access Auditing In Exchange 2007 SP2…
http://www.howexchangeworks.com/2009/09/mailbox-access-auditing-in-exchange.html

"Following are the four actions on which auditing is possible.

* Folder Access - Lets you log events that correspond to opening folders, such as the Inbox, Outbox, or Sent Items folders.
* Message Access - Lets you log events that correspond to explicitly opening messages.
* Extended Send As - Lets you log events that correspond to sending a message as a mailbox-enabled user.
* Extended Send On Behalf Of - Lets you log events that correspond to sending a message on behalf of a mailbox-enabled user."

hope it helps
bbao
link

answered 2011-07-23 at 05:40:18

bbao's gravatar image

bbao

one more MSKB:

How to monitor mailbox access by auditing or by viewing Mailbox Resources in Exchange Server
http://support.microsoft.com/kb/867640
link

answered 2011-07-23 at 06:40:54

bbao's gravatar image

bbao

I just want to say "Thank you" for bbao and for the author.... I am looking for the exact same info.
link

answered 2011-07-23 at 06:45:14

Sulimanw's gravatar image

Sulimanw

Thanks for your information but i have exchange2007 sp1 and i am not in postion to upgade to sp2. Is there any option avalaible for exchange2007 sp1?
link

answered 2011-07-24 at 06:38:59

ManojBojewar's gravatar image

ManojBojewar

as mentioned above, the concept was not from Exchange 2007 SP2, but from the earlier versions back to 2003.

basically, without SP2, the access tracing can be based on the Application Event Log, which gives the essential information about the access.

FYI - How to monitor mailbox access by auditing or by viewing Mailbox Resources in Exchange Server
http://support.microsoft.com/kb/867640

as normally Event Logs are not easy to be accessed by end users or management, some sort of alerts is recommended, such as regular event log filtering or emailing is required.

FYI - Event Trigger Example (Scripting)
http://msdn.microsoft.com/en-us/library/aa446887%28v=vs.85%29.aspx

"This scripting example shows how to create a task that sends an e-mail when an event occurs. The task contains an event trigger that specifies an event query that."
link

answered 2011-07-24 at 09:27:37

bbao's gravatar image

bbao

Manoj.....

If the admin has already removed the full permissions on the mailbox, then I doubt if their is any easy way to track it.  However, if the admin continues to have full permissions on the mailbox...you can run the below PS Command  and play around a little on Excel Pivot to identify the admins who still has the access.  You would be surprised by the results....many don't remove the permissions after troubleshooting on end user mailbox.

get-mailbox -resultsize unlimited | Get-mailboxpermission | where-object { ($_.AccessRights -eq "FullAccess") -and ($_.IsInherited -eq $false) } | Export-csv "C:\Fullperm.csv"

- Habz
link

answered 2011-07-24 at 11:26:54

Habeebmast7's gravatar image

Habeebmast7

Thanks everyone for your great support but i am not able to see mailbox auditing is avalaible in exchange 2007 sp1. please let me know how to enable it on exchange2007 sp1
link

answered 2011-07-24 at 15:03:02

ManojBojewar's gravatar image

ManojBojewar

thanks
link

answered 2011-07-26 at 05:20:39

ManojBojewar's gravatar image

ManojBojewar

Your answer
[hide preview]

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Tags:

×2

Asked: 07/18/2011 08:28

Seen: 255 times

Last updated: 12/13/2011 07:48