Exchange Server Forums

Log mailbox access / identify client

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [Microsoft Exchange 2007] >> Management >> Log mailbox access / identify client

Page: [1]

Message

<< Older Topic Newer Topic >>

Log mailbox access / identify client - 8.Feb.2012 11:25:14 AM

teqmod

Posts: 90
Joined: 23.Sep.2004
From: Maryland
Status: offline

I am looking for a way to identify what machine a user is using to access our Exchange server.

Here is the situation: I have a HR user who is sporadically forwarding messages to a shared mailbox. This happens every couple weeks for a couple hours then stops. This points to a client side rule somewhere. I have verified the account permissions and only this user and the default AD/Exchange accounts have access to the mailbox. The problem is hte user is not computer literate and swears that they only use one machine. We are logging when one user access anothers mailbox and I do not see any instances of this either. The messages are forwarded as they arrive when this happpens which makes me believe this is an automated rule somewhere. I have gone to the users machine and verified they have no rules set up to do this.

So the question is, is there any way to identify what machine a user logs into Exchange from using Outlook so the next time this happens I can trace back to where the problem is coming from?

Post #: 1

Featured Links*

RE: Log mailbox access / identify client - 8.Feb.2012 12:11:31 PM

barbyf

Posts: 17
Joined: 3.Feb.2012
Status: offline

There is a PowerShell command for Exchange 2007 that might return this information.

get-logonstatistics
http://technet.microsoft.com/en-us/library/bb124415%28EXCHG.80%29.aspx

The problem is from what I've seen is that it doesn't always log the ClientName or ClientIP address so it may not be of use. It's at least worth a shot.

You could raise the Mailbox Access Auditing to log Owners logging onto their own mailbox for a small period of time on that particular server and then it would catch that person and where they are logging in from.

(in reply to teqmod)

Post #: 2

RE: Log mailbox access / identify client - 9.Feb.2012 12:32:09 PM

teqmod

Posts: 90
Joined: 23.Sep.2004
From: Maryland
Status: offline

I was hoping that would be it but no luck. It does not show the login to the mailbox. Of course the forward is still happening and I am unable to locate the source for this auto-forward rule. I have also been using ExMon to look at current connections and do not see it.

(in reply to barbyf)

Post #: 3

RE: Log mailbox access / identify client - 9.Feb.2012 1:06:45 PM

teqmod

Posts: 90
Joined: 23.Sep.2004
From: Maryland
Status: offline

Issue resolved. I finally found the issue to be a rule set up in the out of office which explains why it only worked sometimes. This did not show up under the standard rules in Outlook and appears to be a new feature in OL2010.

(in reply to teqmod)

Post #: 4