Exchange Server Forums

Tracking who logs into what email accounts

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [Microsoft Exchange 2003] >> Server Security >> Tracking who logs into what email accounts

Page: [1]

Message

<< Older Topic Newer Topic >>

Limited time MSExchange.org offer! -- 1.Sep.2008 1:00:00 PM

TechGenix and SolarWinds have partnered to provide free copies of SolarWinds Exchange Monitor to all visitors who join the MSExchange.org Forums. SolarWinds Exchange Monitor is a handy desktop dashboard that continuously monitors Microsoft Exchange to deliver real-time insight into Exchange services, mail queue sizes, and host server health. Learn more about Exchange Monitor and the free offer!

Tracking who logs into what email accounts - 4.Apr.2008 11:06:00 AM

rprewitt

Posts: 18
Joined: 4.Apr.2008
Status: offline

Ok Ive just recently been handed the reigns of the Exchange Server so this may end up being a pretty easy question.

Basically we started to allow the users to access their email from the Exchange Server through Web Access. This is great but there is reason to believe that a particular user is accessing other user's email accounts through this process.
Normally I would just force the user to change their password but my higher-ups want to try and find out who is doing this without tipping them off that we are aware of their activities.

Is there a way to track which machine they are using when they access an account?
Are there other ways without installing expensive third party software to monitor logons and where they logon from?

Thanks

< Message edited by rprewitt -- 4.Apr.2008 11:07:00 AM >

Post #: 1

Featured Links*

RE: Tracking who logs into what email accounts - 4.Apr.2008 11:20:44 AM

mark@mvps.org

Posts: 3790
Joined: 9.Jun.2004
From: Philadelphia PA
Status: online

Not unless you're already auditing the events and then you'd have a long old trawl through.
Then of course you've got the "how" part. Either they're logging in with another users ID and password, your security has been compromised because you have put users into the wrong groups (etc), or the user actually does have permission to access the mailbox.
So. Check group membership to make sure that this person doesn't have server-side rights. That will be pretty obvious to see actually.
Check the rights on the target mailbox and see if the rogue user has been given permission by the owning mailbox.
Is the rogue user using his own, someone elses' or an admin account?

_____________________________

Mark Arnold (Exchange MVP)
List Moderator

(in reply to rprewitt)

Post #: 2

RE: Tracking who logs into what email accounts - 4.Apr.2008 11:36:46 AM

rprewitt

Posts: 18
Joined: 4.Apr.2008
Status: offline

Thanks for the fast reply.

My guess is that they have direct access to this user's account because their password has been compromised (just in case I checked everywhere that I could think of where they might have shared access, delegates mainly, shared, groups, etc and came up with nothing)

Im thinking that my only option is to track the logons to the exchange server and when I see unauthorized access to this person's account, somehow pull what machine accessed it. Of course, being new to exchange, I could have missed some other.

And help on how to set this tracking process up to make it as less painful as possible would be appreciated.

(in reply to mark@mvps.org)

Post #: 3