is it possible to track email activity from a user account in a Microsoft Exchange environment? Activity such as email coming in and coming out, edits and etc... Your input is appreciated
Printable View
is it possible to track email activity from a user account in a Microsoft Exchange environment? Activity such as email coming in and coming out, edits and etc... Your input is appreciated
Yes it is, I am not surewhat is native to exchange itself, but there are plenty of third party tools for monitoring and managing exchange environments.
http://www.promodag.com/ad/TGNX/prodlisting.aspx
I don't know about "editing" though?
:)
Yes
Will all depend on how you send receieve mail...
Exchange 2003 System Manager>tools>message tracking
Pretty sure its in previous versions too...
Not sure about edits.....
there are 3rd party tools to track edits and changes....
Guess it depends on what you are trying to do??
MLF
In Exchange, from version 5.5 (from my experience, anyway), there is message tracking. Between that capability and event logs for SMTP, all the activity could be tracked by user, message subject, etc.
There are other possibilities, as well, depending on the additional capabilities applied to your specific network. SMTP Gateway firewalls, content filters, SPAM appliances, whatever.
Also, depending on how your local system is set up, email from months ago can be reproduced and examined from backups.
BTW, everything is saved in the email server. You may delete something, but it still exists on the server, in backup, or in transit.
For edits, that depends on where your Inbox or saved messages are stored. If they are maintained on the server--yep, they have them and they have them in more than one location.
This seems suspiciously like a worried end user wondering about what the admins can do. Anyone who actually admins an Exchange server knows the tracking and reporting capabilities.
Don't Feed The Bears
--TH13
oh but they seem sooooo hungryQuote:
Don't Feed The Bears
and they are kinda cute too......the way they look up to you with those pledding big eyes....
Its so hard not too :D
MLF
Hmmm,
I was under the impression that to get most of the reporting, you have to download the tools from MS:
http://www.microsoft.com/downloads/d...DisplayLang=en
There are certainly lots of third party products that do Exchange reporting.
I don't think that this is an "end uder" question, based on the contents of the OPs other posts.
;)
Nope, johnno, message tracking and logs as I described above are either native to the Exchange install or part of the OS. Add in spam and malware SMTP gateway scanners, other content filtering tools, and you have a pretty deep look into the activity in your email environment.
The link you supplied requires SQL server, and leverages the database to help track statistics. I don't know how deep it goes since I haven't used this particular tool. If you add that to your environment mix, it just makes it harder and harder for naughty little kiddies to mis-behave in email.
The wording of the question leaves things a little confused. I suspect the question is: "can the system admins track my email to and from <so and so>?"Quote:
... activity from a user account ...
In a word: Yes.
That is why email server stores are often listed in court orders.
I agree that the basic answer is yes, although how you would go about it will probably depend on what you are trying to achieve.
For example, not all monitoring is to enforce AUPs or for security reasons.
Resource management, SLAs, productivity and even personnel management are other considerations.
For example, in some environments, the number of e-mails handled would be considered a measure of productivity. Conversely, if someone is having to deal with a disproportionate amount then they are probably under stress, are being over tasked or lack delegation skills.
We would need to know more to provide a more definitive answer?
Right on that, nihil. The SA isn't just going to track an email stream for grins and giggles. It takes time and effort. There are already way too many other things competing for their attention. Just ask MLF.
Automating the process makes it much simpler, granted, when you can get and afford the tools to do so.
In my previous life, when I did go looking and tracing, it was with a vengence because it was never at a convenient time and took me away from the fun things.
;)
your right there Mr RapierQuote:
It takes time and effort. There are already way too many other things competing for their attention. Just ask MLF.
The bears keep me busy :D
I have used the tools to track issues and monitor sudden resource usage as suggested by Nihil
The OP would need admin access to the exchange to use the tracking features...
So if he\she is a user....with no admin access....
I guess we have answered the original question with yes..it is possible
I know there are 3rd party software out there that can more easily track routes,editing, changes etc....mostly to ensure secure email............and I do believe exchange can also do most of these things....although that is a beast that I do not have the time to play with .....and is not required....
at this time anyway
too busy with the bears ;)
MLF
Exchange has built in full journaling capability and has had it since 5.5 SP1. The journaling obviously changed in the way it functions when exchange was revamped in 2000.
It should be noted that this doesn't meet SCC requirements for Sarbanes Oxley retention. Mainly because there is no way to confirm the authenticity of it. For that you would need a product like Symantec KVS or some other "vaulting" product. Most of them rely on the same journaling functionality that Exchange provides
http://support.microsoft.com/kb/261173/en-us
http://support.microsoft.com/kb/239427/en-us
Message tracking is more so an administrative tool to assist in troubleshooting message delivery problems. As you can only track the header information it provides little in the way of journaling.
Some other good MS articles on the subject.
http://support.microsoft.com/kb/843494/en-us
and covering the regulator side of journaling-
http://www.microsoft.com/exchange/ev...n/regcomp.mspx
Hi,
I have had experience with this exact problem.
My solution was to install a POP3 and SMTP sniffer that would create a log of all incoming and outgoing emails and save that to the server.
This thread is THREE years old. Stop spamming with idiotic gibberish.Quote:
Originally Posted by kevomate66
Was about to mention this. All well problem solved. :)Quote:
Originally Posted by gore