RE: Track who logs into my email

["Paul J. Brickett" <swarzkopf () legolas sinnerz us>]

This is relatively easy to set up. In Exchange 2007, an event is written 
to the Application log anytime someone accesses a mailbox for which they 
are not the owner. In earlier versions of Exchange, this is not default 
behavior, but you can still set this up by configuring diagnostic logging 
on the Information Store service.

The event written will be event 1016. It will include the mailbox being 
accessed along with the username of the user who accessed it.

You can then use any event log monitoring tool to look for and alert on 
event 1016 written for your mail box. In the absence of a monitoring 
suite, you can script someone to send you an alert.

-PJB



On Fri, 25 Jan 2008, Worrell, Brian wrote:

> Mike,
>
> Are you an administrator of the Exchange server? or an end user?  As an
> end user, not sure that you would be able to get that information for
> your whole mailbox.  Even as an admin, with the default tools out of the
> box, I think it only showed the last logged in user to the mailbox.
> That could pose an issue if your backup software ran as a user service
> account, it would show them more than likely.
>
> Hope that helps some.
>
> Brian
> -----Original Message-----
> From: listbounce () securityfocus com [mailto:listbounce () securityfocus com]
> On Behalf Of Michael R. Martinez
> Sent: Friday, January 25, 2008 10:27 AM
> To: security-basics () securityfocus com
> Subject: Track who logs into my email
>
> Hello list,
>
> I wanted to know if there is anyway to track who is logging into my
> email on the server side. Exchange 2007on server 2K3 w/outlook client
> 2003. Anything will help.
>
> Thanks,
>
> Mike
> Michael R. Martinez
> TF: 800-987-7307