Exchange Server Forums

Event 1016 - proving real abuse? (and yep read the FAQ)

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [Microsoft Exchange 2000] >> Server Security >> Event 1016 - proving real abuse? (and yep read the FAQ)

Page: [1]

Message

<< Older Topic Newer Topic >>

Limited time MSExchange.org offer! -- 1.Sep.2008 1:00:00 PM

TechGenix and SolarWinds have partnered to provide free copies of SolarWinds Exchange Monitor to all visitors who join the MSExchange.org Forums. SolarWinds Exchange Monitor is a handy desktop dashboard that continuously monitors Microsoft Exchange to deliver real-time insight into Exchange services, mail queue sizes, and host server health. Learn more about Exchange Monitor and the free offer!

Event 1016 - proving real abuse? (and yep read the FAQ) - 26.Feb.2002 5:57:00 PM

JakeS

Posts: 1
Joined: 26.Feb.2002
From: Butte
Status: offline

Hello group!

I work at a financing company where a member of the Exchange Administrators group may be inappropriately accessing other peoples' sensitive mail. I am logging several 1016 errors for this person and the multiple users' mailboxes are not configured for delegation or otherwise shared out (the users' permission tabs indicate only that user as a User). On the same permissions tab there is a reference to the inherited permissions group, which of course lists our exchange administrators group.

I would like to turn on additional diagnostic logging to prove that this user is actually accessing the users' mail, and not "just" their calendar. What specific options do I need to configure to enable this?

Thanks in advance to anyone that can help me with this.

-Jacob "[Confused]"

Post #: 1

Featured Links*

RE: Event 1016 - proving real abuse? (and yep read the ... - 23.Apr.2002 12:49:00 AM

Exchange_pro

Posts: 3
Joined: 11.Apr.2002
From: Arizona, USA
Status: offline

You've probably already found your answers for this by now but:

1- Are you certain that the Admin's account is not connected with any service running on the server? E.g. back-up software, virus scan, etc?

2- 1016 events will be logged whenever _anyone_ accesses any portion of another user's mailbox. Even if I attempt to schedule a meeting and check the other person's calendar. Check here:
Q173692

3- to Increase logging, check out these articles:
Q216233
Q260835
Q274317

Hope that helps.
TCC

(in reply to JakeS)