Alerting Exchange Admins of Unauthorized Mailbox Access

Someone recently asked how to use MOM to send alerts in the even of potentially unauthorized mailbox access. Fortunately, his is easily done. It first requres enabling diagnostic logging on the information store in Exchange System Manager. Exchange 2000 and Exchange 2003 only log event 1016 in the application event log when the diagnostic logging level is set to at least Minimum in the Logons category of the Microsoft Exchange Information Store service. See this KB for details, which includes the precise event generated. http://support.microsoft.com/?kbid=867640 With this in hand, you simply create an event rule to raise an alert for EventID 1016 from Event Source ‘MSExchangeIS Mailbox Store’ to raise the alert and notification.