The event id is the only way I know of, unfortunately it's only a partial solution. 1016 are also triggered when someone views your calendar, or accesses a legitimate shared folder.
They just implemented a solution here InTrust, which monitors event logs, and tracks when people logon to a server with specific IDs. Agents run on each server, but that's all I know about it. On Thu, Aug 14, 2008 at 1:49 PM, Rausch, Michael D <[EMAIL PROTECTED]>wrote: > Nobody has had to do this in the past huh? > > Also, is there any way to track via IP what specific workstation is logging > into a specific mailbox? > > > > -----Original Message----- > From: Rausch, Michael D > Sent: Thursday, August 14, 2008 10:12 AM > To: MS-Exchange Admin Issues > Subject: Tracking logins to specific mailboxes > > Lets say I have 12-30 mailboxes that people might want logons tracked over > a certain period of time? > > > What would everybody recommend the best way for that? I know that event ID > 1016 is logged every time a person not directly associated with the mailbox > logs into it. Is that basically the only way out of the box? Any > recommended 3rd party apps? > > My question would probably be both for 2003 and 2007 as we're in the midst > of our migration. > > Thanks much! > > > > Michael Rausch > > ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ > ~ http://www.sunbeltsoftware.com/Ninja ~ > > ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ > ~ http://www.sunbeltsoftware.com/Ninja ~ > ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja ~
