Exchange 2000 Event ID 1016...

[BenD]

Hello,

I'm trying to help with a log managment solution and it looks like event
1016 in exchange 2000, is too generic for a log collecting/reporting
appliance to determine authorized vs. unauthorized access to inbox or
calendar activity. Are you aware of a configuration that will allow us to
pull data that we need out of 1016 and report on those logs without a high
number of false positives? Please help!

[John Fullbright]

http://www.msexchange.org/tutorials/Auditing-Mailbox-Access-Exchange-System-Manager-Event-Viewer.html

Post by BenD
Hello,
I'm trying to help with a log managment solution and it looks like event
1016 in exchange 2000, is too generic for a log collecting/reporting
appliance to determine authorized vs. unauthorized access to inbox or
calendar activity. Are you aware of a configuration that will allow us to
pull data that we need out of 1016 and report on those logs without a high
number of false positives? Please help!
--
Thank you!
Ben D.