The event id is the only way I know of, unfortunately it's only a partial
solution. 1016 are also triggered when someone views your calendar, or
accesses a legitimate shared folder.
They just implemented a solution here InTrust, which monitors event logs,
and tracks when people logon to a server w
From: Rausch, Michael D [mailto:[EMAIL PROTECTED]
Sent: Thursday, August 14, 2008 4:49 PM
To: MS-Exchange Admin Issues
Subject: RE: Tracking logins to specific mailboxes
Nobody has had to do this in the past huh?
Also, is there any way to track via IP what specific workstation is logging
into a spe
Nobody has had to do this in the past huh?
Also, is there any way to track via IP what specific workstation is logging
into a specific mailbox?
-Original Message-
From: Rausch, Michael D
Sent: Thursday, August 14, 2008 10:12 AM
To: MS-Exchange Admin Issues
Subject: Tracking logins to s
