Mailbox access audit skewed by shared calendars (Full Version)

All Forums >> [Microsoft Exchange 2000] >> Server Security



Message


jsm1119 -> Mailbox access audit skewed by shared calendars (3.May2005 5:04:00 PM)

I have read numeroues posts about how to audit someone accessing others mailboxes. I have tried different methods of auditing and all work.

However, we have shared calendars here and whenever someone opens up a shared calendar, it creates an event and looks the exact same as if someone accessed their mailbox. I am looking for something that is a true tell all of someone getting into another users inbox. For example, if someone opens the I.T. calendar, it shows that person as accessing the mailboxes of everyone in the I.T. group. The only way to know that it is calendar is because of the time stamp. There are others that share their calendars and are not part of groups like this so there is no clear cut way to tell if its actually mailbox access or calendar access.

Can anyone help with this? We have a problem here and I need hard proof. With the fact of the shared calendars, it is still not accurate information.

Thanks for any help in advance!

P.S. I have tried loggin in Diagnostics Logging which is the most informative but floods the app file. This is also skewed by shared calendars. I have also done System Object auditing which works but is skewed as well.




pjhutch -> RE: Mailbox access audit skewed by shared calendars (20.May2005 8:34:00 AM)

Its a well known problem and I haven`t found a solution either.




Page: [1]