<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<!--[if !mso]>
<style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]-->
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>The 2 easiest ways in my opinion would be (as already mentioned):<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Open the mailbox in your Outlook (risk them noticing message
status changes they haven’t read.)<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Exmerge to PST then view the PST. <o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>If users are quite Outlook savvy and are up to no good they may
be purging the deleted items retention area regularly. Any time I have noticed
that it’s a warning sign. When it becomes evident attempts are made to
hide things I break out the “DT”…Dark Toolbox… with
things like packet sniffers and this in it:<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><a
href="http://www.moernaut.com/default.aspx?item=grabberconsole">http://www.moernaut.com/default.aspx?item=grabberconsole</a><o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<div>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>
discuss-bounces@itdiscuss.org [mailto:discuss-bounces@itdiscuss.org] <b>On
Behalf Of </b>Danny Ybarra<br>
<b>Sent:</b> Monday, March 16, 2009 2:49 PM<br>
<b>To:</b> IT Discussion Forum<br>
<b>Subject:</b> Re: [itdiscuss] Mailbox Mirror<o:p></o:p></span></p>
</div>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>You could exmerge the mailbox every 7days. (usually the
default for Shift-deleted items is 14 days retention) You can write a
script to do the exmerge.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Then open the pst from another computer. <o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<div>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Danny Ybarra<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Viant Solutions<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>678-358-4603<o:p></o:p></span></p>
</div>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<div>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>
discuss-bounces@itdiscuss.org [mailto:discuss-bounces@itdiscuss.org] <b>On
Behalf Of </b>Ed Buford<br>
<b>Sent:</b> Monday, March 16, 2009 2:42 PM<br>
<b>To:</b> IT Discussion Forum<br>
<b>Subject:</b> Re: [itdiscuss] Mailbox Mirror<o:p></o:p></span></p>
</div>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Tony,<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>I don’t think this would help you look at sent email. <o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>I think a better method is to give rights to the mailbox and
mount it on the computer(s) you want to monitor it from – the only
problem with this method is that if you click on an unread email you’ll
move it to read status. Another problem is that if the user reads and shift
deletes an email you’ll not know it.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'>-Ed<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> discuss-bounces@itdiscuss.org
[mailto:discuss-bounces@itdiscuss.org] <b>On Behalf Of </b>Tony Dye<br>
<b>Sent:</b> Monday, March 16, 2009 2:29 PM<br>
<b>To:</b> IT Discussion Forum<br>
<b>Subject:</b> Re: [itdiscuss] Mailbox Mirror<o:p></o:p></span></p>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<div>
<p class=MsoNormal>Sure, quite easily. Create that phantom mailbox, as
any other mailbox. In AD, I believe on the Exchange general tab (might be
another), there is an option for forwarding all mail to another address.
Put the address of that new mailbox there. Then look at the option to
also leave the mail in the original mailbox (can't remember if that's a
checkbox to set or one to clear). That's it -- ALL the mail will now end
up in both mailboxes.<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal> <o:p></o:p></p>
</div>
<div>
<p class=MsoNormal>Is that what you had in mind? Note that you could just
as easily create something like a gmail account and forward to it -- nothing
says you have to use Exchange as the second destination...<o:p></o:p></p>
</div>
<div>
<p class=MsoNormal> <o:p></o:p></p>
</div>
<div>
<p class=MsoNormal style='margin-bottom:12.0pt'><br clear=all>
--<br>
Tony Dye<br>
Blog: <a href="http://tonydye.net">http://tonydye.net</a> <br>
Find me on LinkedIn: <a href="http://www.linkedin.com/in/tonydyev2">http://www.linkedin.com/in/tonydyev2</a><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal>2009/3/16 <<a href="mailto:blloyd@buskercom.com">blloyd@buskercom.com</a>><o:p></o:p></p>
<div>
<div>
<p>Does anyone know of a way, in Exchange 2003, to mirror a mailbox to a
“phantom” mailbox? We want to monitor the emails of one of
our users without them being aware of what we are doing.<o:p></o:p></p>
</div>
<p class=MsoNormal style='margin-bottom:12.0pt'><o:p> </o:p></p>
<p style='margin-bottom:12.0pt'><b><span style='font-size:14.0pt;color:navy'>Bill
Lloyd</span></b><span style='color:navy'> </span><span style='font-size:11.0pt;
color:navy'><br>
IT Manager</span><o:p></o:p></p>
<p class=MsoNormal><img border=0 width=149 height=46 id="_x0000_i1025"
src="cid:image001.jpg@01C9A706.4C4A2620"><o:p></o:p></p>
<p><span style='font-size:11.0pt;color:black'>2567 Athens Hwy.<br>
Gainesville, GA 30507<br>
Phone: 770-417-1604<br>
Fax: 770-417-1747<br>
Cell: 404-379-6963</span><o:p></o:p></p>
<p><em><span style='font-size:11.0pt;color:navy'><a
href="mailto:blloyd@buskercom.com" target="_blank">blloyd@buskercom.com</a></span></em><o:p></o:p></p>
<p><span style='font-size:7.0pt;font-family:"Arial","sans-serif";color:navy'>This
email and any accompanying attachments may contain confidential and proprietary
information. If you are not the intended recipient, you are requested to delete
this entire communication immediately. Emails cannot be guaranteed to be secure
or free of errors or viruses. The sender does not accept any liability or
responsibility for any problems that may result from emails you receive.</span><o:p></o:p></p>
</div>
<p class=MsoNormal style='margin-bottom:12.0pt'><br>
_______________________________________________<br>
it discuss mailing list: <a href="mailto:discuss@itdiscuss.org">discuss@itdiscuss.org</a><br>
Mailing List: <a href="http://itdiscuss.org/discuss" target="_blank">http://itdiscuss.org/discuss</a><br>
Web Discussion Board: <a href="http://itdiscuss.org/discuss-forum"
target="_blank">http://itdiscuss.org/discuss-forum</a><br>
Wiki: <a href="http://itdiscuss.org/wiki" target="_blank">http://itdiscuss.org/wiki</a><br>
Internet Relay Chat: irc://<a href="http://irc.freenode.net/citrt"
target="_blank">irc.freenode.net/citrt</a><o:p></o:p></p>
</div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
</body>
</html>