MS Exchange

Begbie · 10 Sep 2010 at 12:14

I need your help here guys,

Some one in work is sending emails from my mailbox, to other members of staff. Now they are fairly humerous, but I want to find out who they are.

Now I would normally check the the permissions set on exchange, but they have removed them.

Is there another, way to check who sent it? Or even check who has previously had permissions to a mailbox on exchange?

Priapus · 10 Sep 2010 at 13:17

I believe you can go into the System Manager and in there, navigate to Server and where you see all the mailboxes - there is a log folder, too. In there, it shows who has logged onto what mailbox.

Might be worth looking there?

Pygmyshrew · 10 Sep 2010 at 13:59

Might also get some clues looking at the mails headers, it depends how they've been accessing it.

Bhoya · 10 Sep 2010 at 15:07

There should be an event logged every time someone opens your calendar or mailbox - think it's event ID 1009 or 1016. Grab the logs around the time of the email and there should be one there saying something like "user xxx accessed mailbox [email protected]" or "user xxx is not the primary Windows 2000 account for mailbox xxx".

Assuming you've got access to the event logs that is.