EXPERT RESPONSE
VIEW MEMBER FEEDBACK
Exchange System Manager displays the last logon and logoff information. Expand a mailbox store, click on Mailboxes -- and a list of mailboxes along with this information is displayed. Similarly, the last accessed and last update received info is displayed in ESM (Exchange Server 2003) when you click on a public folder and select the Status tab.
MEMBER FEEDBACK
This worked, however I noticed that a user's mailbox was last accessed by another user, who doesn't have mailbox access rights. How could this happen?
—Riyas P.
******************************************
It's not possible to access an Exchange mailbox without having access permissions. You must have either Full Mailbox Access permission explicitly granted to you (or a security group you are a member of ) or the login credentials of a user who "owns" the mailbox (in which case, the mailbox owner's name should show up).
In Exchange 2000, however, access was possible if you weren't a member of Administrators or Domain Admins groups by making the account a member of the Exchange Domain Servers group (see Microsoft KB article 262054, How to get service account access to all mailboxes in Exchange 2000). Inherited store permissions can also allow you to access mailboxes.
Permissions can also be delegated or assigned by users (e.g., permissions assigned to assistants to access a Calendar or Contacts folder).
You should also take a look at Event ID 1016 in the Security event log to monitor mailbox access. For more info about this Event ID, refer to Microsoft KB article 867640 How to monitor mailbox access by auditing or by viewing Mailbox Resources in Exchange Server."
—Bharat Suneja, Exchange Server Administration expert
******************************************
Is there a way to change the amount of time the log stores data? We checked it after having Exchange for four months, and it only shows us about the last week or so of access. We wanted to keep logs for at least six to twelve months, if possible.
—Martin E.
******************************************
Event Logs can be configured to store more or less data. On Windows Server 2003, follow the following steps to change the Event Log settings:
- Start Event Viewer.
- Right click the Event Log you want to modify, such as Application, Security, System, etc.
- Select Properties.
- In the "Log size" section, modify the "Maximum log size" as required.
- You can also control what happens when the log reaches the maximum size. The choices:
- Overwrite older events as needed.
- Overwrite events older than specified number of days.
- Do not overwrite older events (clear log manually).
—Bharat Suneja, Exchange Server Administration expert
Do you have comments on this Ask the Expert Q&A? Let us know.
Related information from SearchExchange.com:
FAQ: Exchange public folders
Crash Course: A tour of Exchange System Manager
Exchange Admin 101: Introducing public folders
Reference Center: Exchange 2003 tips and resources
Reference Center: Exchange System Manager tips and resources
|
