Help Please! Message Logging on MS Exchange 2003

[roadsweeper]

Hi

I have a friend who needs to monitor the content (as opposed to just the email addresses used) of incoming and outgoing emails sent my an employee of his through their email server (MS Exchange 2003). According to him the log files are only showing the email addresses involved and not the email content itself. I was sure MS Exchange allows admins to log/view the content of sent/received emails - how can he do this? (Detailed instructions would be much appreciated if possible please!)

Thanks.

roadie.

[malman]

Exchange 2003 specifically denies admins access to users mailboxes. There are third party tools which will allow you to monitor email from specific boxes but no built in tools that I know off.

Before doing any of this I would consult a good lawyer as the position on monitoring mail/web access was not clear the last I heard. Any lawyers on here or anyone who has experience of this care to comment?

There are still ways that it can be done but each has its drawbacks.
1)You can give a user who is not a member of the admin group access to the full mailbox using active directory user permissions. Then "exchange advanced" and "mailbox rights". Add the user and give them whatever access you need (full access if needed). You can then read the mailbox logged in as your non admin user using outlook or Outlook web access.

Problem is you will mark messages as read and process read receipts in the process of reading it so if you are trying to keep it quiet you will give yourself away.


2) you can use message journaling or archiving to copy all mail to a separate mailbox. This is done in the exchange system manager. Navigate to the mailbox store and turn on archiving. You will need a destination (might need to be a public folder to stop an archive loop haven't tried this so check first). You also have to set permissions on the public folder to allow the store to contribute messages.

Just found this article
http://support.microsoft.com/default.

Problem is this archives for the entire message store not just one mailbox so its a bit of a blunderbus approach.

Not aware of any other built in tools that would allow you to do this.

Disclaimer:
read the lawyer bit above - not my fault / don't blamw me etc.

[roadsweeper]

Many thanks Neil, your help is much appreciated.

Do you have any recommendations for a suitable third party tool? They are intending just to use it this once so a free or low-cost tool would be ideal in the short-term. Any suggestions you have for a more long-term tool would be appreciated too.

Thanks again.

roadie.

PS: Nice motor!

[_DeeJay_]

roadsweeper said:

Many thanks Neil, your help is much appreciated. Do you have any recommendations for a suitable third party tool? They are intending just to use it this once so a free or low-cost tool would be ideal in the short-term. Any suggestions you have for a more long-term tool would be appreciated too. Thanks again. roadie. PS: Nice motor!

You can certainly log to a mailbox. Which version of Exchange are you running? If it's Enterprise, you could just create another store, enable journalling on that store and move the mailbox to be tracked into it (and log to a mailbox in the primary store).

It's difficult for a 3rd party application to do this (there are some, but most just track SMTP messages as that's much easier to do technically).

If you're licensed for it, you can upgrade to Enterprise (takes about 20 mins and is easy) but it's probably a lot of hassle just for this purpose....

Darren

[malman]

I run exchange enterprise so if I had to do it I would use the method Deejay posted. I haven't used any third party tools to do it so I can't really reccommend any. A google search and then try and find some reviews is probably your best bet.

P.S.
Thanks and its for sale to fund another TVR (I think I might be hooked )

[_DeeJay_]

roadsweeper said:

Hi I have a friend who needs to monitor the content (as opposed to just the email addresses used) of incoming and outgoing emails sent my an employee of his through their email server (MS Exchange 2003). According to him the log files are only showing the email addresses involved and not the email content itself. I was sure MS Exchange allows admins to log/view the content of sent/received emails - how can he do this? (Detailed instructions would be much appreciated if possible please!) Thanks. roadie.

This may sound daft - but you could grant access to another user in order to read their mail/send items. It's obviously not the most elegant solution but unless the user is clever enough not to store sent messages in their 'sent items' folder (which is very unlikely) you'll be able to see what they've send/received, even if they've deleted the messages (tell your friend to lookup 'deleted item retention')

Darren.

[malman]

_DeeJay_ said:

roadsweeper said: Hi I have a friend who needs to monitor the content (as opposed to just the email addresses used) of incoming and outgoing emails sent my an employee of his through their email server (MS Exchange 2003). According to him the log files are only showing the email addresses involved and not the email content itself. I was sure MS Exchange allows admins to log/view the content of sent/received emails - how can he do this? (Detailed instructions would be much appreciated if possible please!) Thanks. roadie. This may sound daft - but you could grant access to another user in order to read their mail/send items. It's obviously not the most elegant solution but unless the user is clever enough not to store sent messages in their 'sent items' folder (which is very unlikely) you'll be able to see what they've send/received, even if they've deleted the messages (tell your friend to lookup 'deleted item retention') Darren.

Thats Number 1 but you have to be careful with read receipts and marking items as read etc. Also "shift+delete" bypasses the standard deleted item retension as it doesn't go through deleted items. You can hack the registry on your exchange box and turn on deleted item retension for all folders. There's an MSKB article about it somewhere

[_DeeJay_]

malman said:

_DeeJay_ said: roadsweeper said: Hi I have a friend who needs to monitor the content (as opposed to just the email addresses used) of incoming and outgoing emails sent my an employee of his through their email server (MS Exchange 2003). According to him the log files are only showing the email addresses involved and not the email content itself. I was sure MS Exchange allows admins to log/view the content of sent/received emails - how can he do this? (Detailed instructions would be much appreciated if possible please!) Thanks. roadie. This may sound daft - but you could grant access to another user in order to read their mail/send items. It's obviously not the most elegant solution but unless the user is clever enough not to store sent messages in their 'sent items' folder (which is very unlikely) you'll be able to see what they've send/received, even if they've deleted the messages (tell your friend to lookup 'deleted item retention') Darren. Thats Number 1 but you have to be careful with read receipts and marking items as read etc. Also "shift+delete" bypasses the standard deleted item retension as it doesn't go through deleted items. You can hack the registry on your exchange box and turn on deleted item retension for all folders. There's an MSKB article about it somewhere

Not true (but close). No matter how items are deleted, deleted item retention is applied to them. Are you sure you're not confusing it with the regisry hack for Outlook which allows you to view the contents of items deleted from other folders?

If you don't believe me, shift-delete a mail then view the files that have been retained using OWA.

D

[malman]

If I shift delete an item (no dumpster reg hack enabled on my outlook 2000) its not in deleted item recovery. I checked it with OWA and its still gone there too (thats on EXCH2003 without SP1).

This article suggests that you must have the reg hack on the clients all the way up to outlook 2003 to get hard deleted stuff back.
http://support.microsoft.com/default.aspx?scid=kb;en

Does this work for you without the hack?

P.S.
My memory told me it was a server side hack but now that I've check it is client side.


>> Edited by malman on Monday 14th November 11:41

[_DeeJay_]

malman said:

If I shift delete an item (no dumpster reg hack enabled on my outlook 2000) its not in deleted item recovery. I checked it with OWA and its still gone there too (thats on EXCH2003 without SP1). This article suggests that you must have the reg hack on the clients all the way up to outlook 2003 to get hard deleted stuff back. http://support.microsoft.com/default.aspx?scid=kb;en Does this work for you without the hack? P.S. My memory told me it was a server side hack but now that I've check it is client side. >> Edited by malman on Monday 14th November 11:41

You're correct - you need to reg hack Outlook to be able to see the items shift-deleted.
If you don't want to do that, you need to modify the URL when viewing folders through OWA 'http://server/exchange/user/inbox?cmd=showdeleted' or something like that.

Darren.

edited to say: The usual point of confusion is that deleted item retention is controlled by the client (i.e. you need to tell Outlook to behave differently when using shift-delete. I was just trying to point out that isn't the case; the reg hack just enables the option that lets you check for previously deleted items in folders other than 'deleted items').



>> Edited by _DeeJay_ on Tuesday 15th November 11:09

[malman]

_DeeJay_ said:

You're correct - you need to reg hack Outlook to be able to see the items shift-deleted. If you don't want to do that, you need to modify the URL when viewing folders through OWA 'http://server/exchange/user/inbox?cmd=showdeleted' or something like that.

You're right too - I had never seen that OWA url before but that is now squirrelled away in my brain as I'm sure it'll come in handy.