View Single Post
  #5  
Old September 3rd 07, 09:00 PM posted to microsoft.public.outlook,microsoft.public.outlook.general
Roady [MVP]
external usenet poster
 
Posts: 2,620
Default Outlook Forensics

You can enable Auditing for this on Exchange. Of course you need to
configure this beforehand and not afterwards; it won't be logged if auditing
isn't configured.

--
Robert Sparnaaij [MVP-Outlook]
Coauthor, Configuring Microsoft Outlook 2003
http://www.howto-outlook.com/
Outlook FAQ, HowTo, Downloads, Add-Ins and more

http://www.msoutlook.info/
Real World Questions, Real World Answers

-----

"Warren Guffey" wrote in message
...
I have a situation in which my boss wants to know if I can prove if someone
was actually viewing another person's mailbox. The user had rights to the
other person's mailbox but denies actually reading anything. Upon
inspection the mailbox in question was not in the folder list but I have
been given the task of proving or disproving that the user actually
accessed the mailbox. I have checked on local log files or dat files but
couldn't find anything to help. Isn't there a log in Exchange to find this
information, not just last login but a history of logins? Is there any
other software or service that would be able to show when a user may attach
or detach a mailbox? Any help or direction would be appreciated as I am
under some heavy pressure here to accomplish this task.

Ads