log events in the event log

I want to be able to track when a user connects to their mailbox. I have 
someone who is trying to connect to other mailboxes and I want this to be log 
in the event log. I would like to show the user name and the mailbox they 
tried to connect to in the same event. Is there a way to do this?

Thanks in advance for your help...

0
faf1967 (7)
3/31/2006 8:18:02 PM
exchange.admin 57650 articles. 1 followers. Follow

6 Replies
562 Views

Similar Articles

[PageSpeed] 50

Question for you...Does this person who is attempting to connect to the 
mailboxes have full exchange administrator rights on the Exchange Org?  If 
so, you may want to refer to a previous post as this same question was asked 
and then answered.

Jermaine

"faf1967" wrote:

> I want to be able to track when a user connects to their mailbox. I have 
> someone who is trying to connect to other mailboxes and I want this to be log 
> in the event log. I would like to show the user name and the mailbox they 
> tried to connect to in the same event. Is there a way to do this?
> 
> Thanks in advance for your help...
> 
0
jermaine (71)
3/31/2006 8:28:04 PM
This person does not have admin rights. They are just one of those people who 
like to learn things at home and then try it out at work. 

Also what post are you referring to?

Thanks,

"Jermaine" wrote:

> Question for you...Does this person who is attempting to connect to the 
> mailboxes have full exchange administrator rights on the Exchange Org?  If 
> so, you may want to refer to a previous post as this same question was asked 
> and then answered.
> 
> Jermaine
> 
> "faf1967" wrote:
> 
> > I want to be able to track when a user connects to their mailbox. I have 
> > someone who is trying to connect to other mailboxes and I want this to be log 
> > in the event log. I would like to show the user name and the mailbox they 
> > tried to connect to in the same event. Is there a way to do this?
> > 
> > Thanks in advance for your help...
> > 
0
faf1967 (7)
3/31/2006 9:04:03 PM
Well, if they don't have admin rights this is different.  The only way a 
normal user can access another users mailbox is if they are given 
administrative rights on that users mailbox via Active Directory under the 
Exchange advanced tab/mailbox rights or if that users gives them access to 
their mailbox themself.  In most scenarios a user will give another user 
access to their calendar and not their inbox.  How do you know this user is 
accessing other mailboxes?

Jermaine

"faf1967" wrote:

> This person does not have admin rights. They are just one of those people who 
> like to learn things at home and then try it out at work. 
> 
> Also what post are you referring to?
> 
> Thanks,
> 
> "Jermaine" wrote:
> 
> > Question for you...Does this person who is attempting to connect to the 
> > mailboxes have full exchange administrator rights on the Exchange Org?  If 
> > so, you may want to refer to a previous post as this same question was asked 
> > and then answered.
> > 
> > Jermaine
> > 
> > "faf1967" wrote:
> > 
> > > I want to be able to track when a user connects to their mailbox. I have 
> > > someone who is trying to connect to other mailboxes and I want this to be log 
> > > in the event log. I would like to show the user name and the mailbox they 
> > > tried to connect to in the same event. Is there a way to do this?
> > > 
> > > Thanks in advance for your help...
> > > 
0
jermaine (71)
3/31/2006 9:20:01 PM
You can enable diagnostics logging on Exchange.  In ESM, go to server 
properties, Diagnostics Logging tab, then under services, select 
MSExchangeIS\Mailbox and on the right side select Logons - experiment with 
which logging level gets you the results you want.  This should now log an 
event whenever someone accesses a mailbox (it doesn't just do failures!). 
Be aware that this also logs events and indicates "joe user logged on to 
mailbox X and is not the primary owner" for things such as accessing 
free.busy information for a user (which should not be construed as 
attempting to access the mailbox).

In a nutshell, while this logging will provide some information, much of it 
is unreliable and does almost nothing to prove that someone atempted to 
actually access another's mailbox.

The best thing to do is to ensure that permissiosn are in order - this will 
prevent any unauthorized access to mailboxes.

Ed Crowley's famous quote comes to mind here:

"There are seldom good technological solutions for behavioral problems"

-- 
Ben Winzenz
Exchange MVP
MessageOne
Read my blog!
http://winzenz.blogspot.com
http://feeds.feedburner.com/winzenz (RSS Feed)


"faf1967" <faf1967@discussions.microsoft.com> wrote in message 
news:64A9DFE5-D1E1-4283-A458-C8B9E156512B@microsoft.com...
>I want to be able to track when a user connects to their mailbox. I have
> someone who is trying to connect to other mailboxes and I want this to be 
> log
> in the event log. I would like to show the user name and the mailbox they
> tried to connect to in the same event. Is there a way to do this?
>
> Thanks in advance for your help...
> 


0
Ben
3/31/2006 9:23:39 PM
Thanks, that is exactly what I was looking for... it logs event id 1013 when 
someone manually connects to someone's mailbox & event 1016 for someone who 
already has another mailbox connected.

Thanks


"Ben Winzenz [Exchange MVP]" wrote:

> You can enable diagnostics logging on Exchange.  In ESM, go to server 
> properties, Diagnostics Logging tab, then under services, select 
> MSExchangeIS\Mailbox and on the right side select Logons - experiment with 
> which logging level gets you the results you want.  This should now log an 
> event whenever someone accesses a mailbox (it doesn't just do failures!). 
> Be aware that this also logs events and indicates "joe user logged on to 
> mailbox X and is not the primary owner" for things such as accessing 
> free.busy information for a user (which should not be construed as 
> attempting to access the mailbox).
> 
> In a nutshell, while this logging will provide some information, much of it 
> is unreliable and does almost nothing to prove that someone atempted to 
> actually access another's mailbox.
> 
> The best thing to do is to ensure that permissiosn are in order - this will 
> prevent any unauthorized access to mailboxes.
> 
> Ed Crowley's famous quote comes to mind here:
> 
> "There are seldom good technological solutions for behavioral problems"
> 
> -- 
> Ben Winzenz
> Exchange MVP
> MessageOne
> Read my blog!
> http://winzenz.blogspot.com
> http://feeds.feedburner.com/winzenz (RSS Feed)
> 
> 
> "faf1967" <faf1967@discussions.microsoft.com> wrote in message 
> news:64A9DFE5-D1E1-4283-A458-C8B9E156512B@microsoft.com...
> >I want to be able to track when a user connects to their mailbox. I have
> > someone who is trying to connect to other mailboxes and I want this to be 
> > log
> > in the event log. I would like to show the user name and the mailbox they
> > tried to connect to in the same event. Is there a way to do this?
> >
> > Thanks in advance for your help...
> > 
> 
> 
> 
0
faf1967 (7)
3/31/2006 10:06:04 PM
Right, but be careful.  As I mentioned, not all of these events indicate 
connecting to a mailbox.  Many of them (most, actually) simply refer to 
accessing calendar data.  Unfortunately, there really isn't a good way to 
audit the information you want.  Perhaps that will be different in E12...

-- 
Ben Winzenz
Exchange MVP
MessageOne
Read my blog!
http://winzenz.blogspot.com
http://feeds.feedburner.com/winzenz (RSS Feed)


"faf1967" <faf1967@discussions.microsoft.com> wrote in message 
news:1C0DE8A0-6A54-45CD-A284-B52208827525@microsoft.com...
> Thanks, that is exactly what I was looking for... it logs event id 1013 
> when
> someone manually connects to someone's mailbox & event 1016 for someone 
> who
> already has another mailbox connected.
>
> Thanks
>
>
> "Ben Winzenz [Exchange MVP]" wrote:
>
>> You can enable diagnostics logging on Exchange.  In ESM, go to server
>> properties, Diagnostics Logging tab, then under services, select
>> MSExchangeIS\Mailbox and on the right side select Logons - experiment 
>> with
>> which logging level gets you the results you want.  This should now log 
>> an
>> event whenever someone accesses a mailbox (it doesn't just do failures!).
>> Be aware that this also logs events and indicates "joe user logged on to
>> mailbox X and is not the primary owner" for things such as accessing
>> free.busy information for a user (which should not be construed as
>> attempting to access the mailbox).
>>
>> In a nutshell, while this logging will provide some information, much of 
>> it
>> is unreliable and does almost nothing to prove that someone atempted to
>> actually access another's mailbox.
>>
>> The best thing to do is to ensure that permissiosn are in order - this 
>> will
>> prevent any unauthorized access to mailboxes.
>>
>> Ed Crowley's famous quote comes to mind here:
>>
>> "There are seldom good technological solutions for behavioral problems"
>>
>> -- 
>> Ben Winzenz
>> Exchange MVP
>> MessageOne
>> Read my blog!
>> http://winzenz.blogspot.com
>> http://feeds.feedburner.com/winzenz (RSS Feed)
>>
>>
>> "faf1967" <faf1967@discussions.microsoft.com> wrote in message
>> news:64A9DFE5-D1E1-4283-A458-C8B9E156512B@microsoft.com...
>> >I want to be able to track when a user connects to their mailbox. I have
>> > someone who is trying to connect to other mailboxes and I want this to 
>> > be
>> > log
>> > in the event log. I would like to show the user name and the mailbox 
>> > they
>> > tried to connect to in the same event. Is there a way to do this?
>> >
>> > Thanks in advance for your help...
>> >
>>
>>
>> 


0
Ben
3/31/2006 10:40:43 PM
Reply:

Similar Artilces:

Capture event when exit Column G
I want to code something whenever there's a change in Column G/8. Some users use the Mouse, others use the Tab, others use the Enter key, so it isn't just a Target.Column=9 deal. Would someone please start me in the right direction for coding on exit of a cell in Column G/8? TIA Hi I'd use the slection_change event. Put the following code in your worksheet module: (Note: column G ist the 7th column) Private Sub Worksheet_SelectionChange(ByVal Target As Range) Static old_column As Integer If Target.Column <> 7 Then If old_column = 7 Then MsgBox "you jus...

Unable to log into my Outlook mail
I can log into my win2k domain, but when I open my outlook I get prompted for username, password,and domain. When I enter the correct info, the system replies that it's incorrect. I have tried changing passwords and many other fixes, including uninstalling and reinstalling office and still can't get it to work. I can log into outlook and my account from a different computer, but not from mine. Scanned my computer with Norton NAV. On the client side, using Outlook 2002, with winXP sp1, office 2002 sp1 & 2. On the server side, using echange 2000 with sp 3, windows 2000 ser...

Event ID 9519
This is a multi-part message in MIME format. --------------050203000205000406030504 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Hello Newsgroup, I'm having a bit of a challenge here. I'm trying to assist a colleague with the following issue. They have a *Windows 2000 server* and a *Exchange Server 2000 Standard* setup. Everything is working fine except that the Exchange server server crashed for reasons that they cannot say. Now I went through and did a *eseutil /mh /r /k /g* and then unfortunately a */p*. Doing all of that brough...

Publisher-Calendar-re-occuring events
How do I have an event carry over to a new calendar without copy and paste? Copy and Paste, or use a database and Merge the information. -- ...

Online Log Size
I've got a 40G SS 2005 table without indexes that I need to add a clustered index to. I know that if I do a standard index addition, it will write out about 40G to the log and I was hoping to avoid that. If do the ONLINE option for building this clustered index, will it write out significantly less to the log by any chance? Nope - but, you can try changing the recovery model to BULK-LOGGED and seeing if that reduces the amount of data recorded in the transaction log. Remember to change the recovery model back to full after the index has been rebuilt. Note: the transact...

Charting timed events throughout a month
I thought I had a simple task to perform for work. Then, I trie charting it in Excel and have not had any luck. I need to take some simple data and for each day of the month, I nee to chart some usage times (24 hour clock). What we want to identify i where simultaneous instances occured. Example data: Date Start Time Stop Time 11/1/03 09:03 09:53 11/1/03 10:21 10:25 11/1/03 10:23 10:54 11/1/03 14:56 15:31 11/1/03 15:17 15:49 I've no clue how to set this up. I thought I mig...

Circular Logging
Can circular logging in Exchange 2003 really free up 20 GB of hard disk space? I enabled it and I was amazed to see my free space five-fold. yip, not necessarily 20mb but just make sure u backup the transaction logs, u will need when u do a restore of your database. "Josh" <Josh@puzzled.com> wrote in message news:26a701c4aada$a7d2f7b0$a501280a@phx.gbl... > Can circular logging in Exchange 2003 really free up 20 GB > of hard disk space? I enabled it and I was amazed to see > my free space five-fold. Josh wrote: > Can circular logging in Exchange 2003 r...

log events in the event log
I want to be able to track when a user connects to their mailbox. I have someone who is trying to connect to other mailboxes and I want this to be log in the event log. I would like to show the user name and the mailbox they tried to connect to in the same event. Is there a way to do this? Thanks in advance for your help... Question for you...Does this person who is attempting to connect to the mailboxes have full exchange administrator rights on the Exchange Org? If so, you may want to refer to a previous post as this same question was asked and then answered. Jermaine "faf19...

Events 9153 and 9188, need some help
Greetings, having an issue here would like some advice on. Running Exchange SP1 2003 server. Every 13 mins and 15 mins I get event ID's 9153 and 9188, respectively. The Exchange Domain Servers and Exchange Enterprise Server groups are in the Users container and have always been in that container, never moved. The errors apparently appear because it cannot read the group memberships. The local computer object of the server is a member of the Exchange Domain servers group as well. Everything is as it should be according to the KB on MS support. After much digging I found an interestin...

Diagnostics Logging
Some email to some domains can't be delivered showing as "The connection was dropped by the remote host" What type of logging should I enable to troubleshoot this? THanks also, where does it log too be default? "James" <fake@email.com> wrote in message news:uxUhWt9eEHA.1652@TK2MSFTNGP09.phx.gbl... > Some email to some domains can't be delivered > showing as "The connection was dropped by the remote host" > > What type of logging should I enable to troubleshoot this? > > THanks > > ...

MSExchangeAL event ID 8333
I'm getting the following message every minute in the application log. None of my recipient policies are updating the users in AD. Any ideas? I can't find anything on it via microsoft or google. Event Type: Error Event Source: MSExchangeAL Event Category: Address List Synchronization Event ID: 8331 Date: 1/29/2004 Time: 12:08:01 PM User: N/A Computer: DRAGAS-MAIL Description: The service threw an unexpected exception which was caught at f:\titanium\dsa\src\lra\abv_dg\lservagent.cpp (4511) For more information, click http://www.microsoft.com/contentredirect.asp. The fol...

Old event procedure not working in Access 2007
Have a db created probably in Access 97, or earlier, that has worked in access 2000 for 5 years just fine. After installing Office 2007 (left the 2000 versions of Access, Word, and Excel on the PC) I have a problem with it. Double Click on the file name, Access 2000 opens the db ok and displays the Main Form which has 4 command buttons. When I click on 3 of the 4 buttons I get the following error: The expression On Click you entered as the event property setting produced the following error: Object or class does not support the set of events. · the expression may not result ...

Problem with log in to Vista
I've got a problem with my Vista (Home Premium) I tried to log in in the morning and this problem occured - all of my desktop icons (same goes to wallpaper) vanished, my Windows taskbar won't open and I can only browse my computer through one explorer window that popped out during a log in (I can browse all the areas/hdd's of my pc) I scanned my OS with AVG antivir but the problem still occurs. It's been 8 months since I install the system (and i've got all the updates) and I never had a problem like this before. What is it? Is it a virus or any other piece of m...

Event 3084 and Exchange 2003
Hi We have two Exchange 2003 servers running in native mode. Some of our Public folders do not seem to be replicating. Our Exchange environment was recently upgraded from 5.5 and any Public folder that was created before the upgrade still replicates. New folders do not, that is the folder structure replicates but not the content. I have increased the logging and we get multiple events 3084. Event Type: Warning Event Source: MSExchangeIS Public Store Event Category: Replication Errors Event ID: 3084 Date: 29/06/2004 Time: 2:41:38 p.m. User: N/A Computer: ****** Description: Error (0xf...

How to log internet header of incoming emails?
Hello, I want to log internet header of incoming emails. I want to see the content of the Bcc field. Is it possible? And if yes, how and where I have to config the log settings in exchange server? We use exchange 2000. Thanks. Regards Christian You can create a rudimentary log of incoming mail using the SMTP protocol logging feature of the SMTP virtual server. It will not record the BCC field or any of the message content, though. The BCC field would be inside the RFC 2822 header of the message. To record anything in that you would need an SMTP protocol sink. The Archive sink mig...

creating a log sheet
Hi all, I've created a method to capture current user (network username) and a date / time stamp. I want this output to be logged on a hidden sheet called 'log' strangely enough! How does it find the next available line in log to output to? tia see if this will help you. you didn't give too specific of a description, so hopefully this is what you're looking for lastRow = Worksheets("log").Cells(Rows.Count, "A").End(xlUp).Row range("A: & lastrow +1) = "your date/time stamp code" -- Gary "sacrum" <sacrum...

Check last form to be closed and fire event
Is it possible to check if a form has just been closed? I have a form that has values updated when a related form is closed. I then want to automatically change other values on the open form. This uses code placed on a fields before update event which works fine when changed manually but does not fire when the field is programmatically updated. I have read that I could call the event in code. I am not sure which event to attach the code to now. Can I use the got focus event of the form as the second form closes? Also is it possible to check if the form has just closed and use this as a ...

Event after Dialog Launches
I'm trying to find an event for after a dialog is displayed to the user. Every event I try, such as WM_SHOWWINDOW or WM_ACTIVATE, all seem to get called before the dialog is actually displayed. Does anyone know the event I can call after the dialog is displayed without having to create a button and call its ONCLICKED event? Thanks ahead of time. Mark Is trapping bShow == TRUE in WM_SHOWWINDOW too late? If so what are you trying to do? M "Mark" <Mark@discussions.microsoft.com> wrote in message news:08DDB1E2-1FC9-41A5-AFDE-AD207144EC33@microsoft.com... > I'...

OWA, log in to .. log out?
hi Exch 2k3 1 FE server no forms based auth here(yet) This weekend I put a FE server out and put a SSL cerfiticate on it. The name in the certificate is not the same as the server, however our internet facing DNS has an A record for it with the name that is used in the certificate. after the migration I have a small number of users, about 10 out of 1000 that when using OWA get asked to enter credentials when they click "log off". why? Also, because i think its maybe related. This FE server is physically inside our network behind a pix. One thing I wanted to achieve but...

How to find out if a user has logged on ?
Hi: Within a Windows Service, is there a way to find out if a user (any user) has already logged on to the machine ? Thanks In Advance ! Polaris You can use NetWkstaGetInfo with a level of 102 to get the number of logged on users. And NetWkstaUserGetInfo will give you information about the logged in user. AliR. "Polaris" <etpolaris@hotmail.com> wrote in message news:%23pmkzBWYFHA.3320@TK2MSFTNGP12.phx.gbl... > Hi: > > Within a Windows Service, is there a way to find out if a user (any user) > has already logged on to the machine ? > > Thanks In Advanc...

Programmatically Accessing the Event
I need to edit the on click events for ALL of my command buttons in a large access program. Is there any way to step thru each form and open the file containing all the event procedures. Make changes and then save these changes. ras wrote: >I need to edit the on click events for ALL of my command buttons in a large >access program. Is there any way to step thru each form and open the file >containing all the event procedures. Make changes and then save these >changes. Use this kind of procedure in your design utility module. Public Sub FixClick() Dim db As Databa...

log-log charts
can't create log-log chart in excel 2000. There is a selection under format axis to choose log scale for the Y- axis but there is no selection for choosing log scale for the x-axis. can anyone help? Hi CT, You need to plot a xy-scatter in order to have log scale on the x axis. Sounds like you are using the line chart type. Where the x axis is a category axis. Cheers Andy CT wrote: > can't create log-log chart in excel 2000. There is a > selection under format axis to choose log scale for the Y- > axis but there is no selection for choosing log scale for > the x-...

Can not see Domain box when logging into OWA
Exchanger Server 2000, Windows 2000 Server. We have a Windows 2003 DC. Our client computers running XP are not able to login into OWA because they can't see the domain box, when they enter in their username and password. What can I do? Have them logon with their UPN. user@yourADDomain.local On Tue, 19 Apr 2005 15:23:01 -0700, "Kristina" <Kristina@discussions.microsoft.com> wrote: >Exchanger Server 2000, Windows 2000 Server. We have a Windows 2003 DC. Our >client computers running XP are not able to login into OWA because they can't >see the d...

Lots of application event log entries... is this normal?
I need a bit of help making some sense out of my event log. Hopefully someone can lend a hand. Sorry if this is long. I have an Exchange Server 2003 recently set up and servicing a 50-user company. I was browsing the application even log and I am getting regular and frequent (several every minute, to every few minutes) warnings and one particular error. I believe that most of these are related. BTW the system is performing just fine, I am just uneasy with the presence of all of those warnings . Here are the symptoms I have observed are: Error/Event ID: 7004 - no help from Micros...

Event ID 3018
I am trying to figure out how to stop this message from showing up in the event logs. Logging is set to none and registry entries are set to 0. Any help would be greatly appreciated. Thank you, Jason Sevier ============================================================= EVENT # : 911469 EVENTLOG : Application EVENT TYPE : ERROR SOURCE : MSExchangeTransport CATEGORY : NDR EVENT ID : 3018 COMPUTER : TIME : 8/10/2004 11:24:02 AM MESSAGE : A non-delivery report with a status code of 5.4.0 was generated for recipient rfc822;Jwhitewood@aol.co (Message-ID <9157...