Monitoring Non-Owner Mailbox Access
Netwrix Auditor can monitor non-owner access to mailboxes in on-premises Exchange organization. The following mailbox types will be monitored by default:
- UserMailbox
- EquipmentMailbox
- LinkedMailbox
- RoomMailbox
Here is the list of actions captured:
| Item | Action | Audited | How this change is reported by the product |
|---|---|---|---|
|
Emails and Folders |
New email |
Yes |
The message was created in \Drafts folder with subject <...> |
|
A user with Send as or Send on behalf permissions tried to send an email |
Yes |
Message located in Root with subject <...> was queued for delivery to IPM.Message. |
|
|
Delete email |
Yes |
Message with subject <...> was moved from folder \Drafts to folder \Deleted Items. |
|
|
Move email to another folder |
Yes |
Message with subject <...> was moved from folder <...> to folder <...>. |
|
|
Create rules for emails |
No |
— |
|
|
Email read attempt |
No |
— |
|
|
New folder |
No |
— |
|
|
Open folder |
Yes |
The folder <...> was opened. |
|
|
Delete folder |
Yes
|
Folder <...> was moved from folder <...> to folder \Deleted Items. |
|
|
Empty folder |
Yes |
The folder <...> was opened. |
|
|
Edit folder permissions |
No |
— | |
|
Calendar |
New event |
Yes |
Message was created in \Calendar with subject <...>. |
|
Event read attempt |
No |
— |
|
|
Edit event |
Yes |
Message located in \Calendar with subject <...> was modified. |
|
|
Delete event |
Yes |
Message with subject <...> was moved from folder \Calendar to folder \Deleted Items. |
|
|
People |
New contact |
Yes |
Message was created in \Contacts\Recipient Cache with subject <contact name>. |
|
Contact read attempt |
Yes |
Folder \Contacts\Recipient Cache was opened. |
|
|
Edit contact |
No |
— | |
|
Delete contact |
Yes |
Message with subject <...> was moved from folder \Contacts to folder \Deleted Items. |
|
|
Tasks |
New task |
Yes |
Message was created in \Tasks with subject <...>. |
|
Task read attempt |
No |
— | |
|
Edit task |
Yes |
Message located in \Tasks with subject <...> was modified. |
|
|
Delete task |
Yes |
Message with subject <...> was moved from folder \Tasks to folder \Deleted Items. |