For this many administrators to indicate a need or desire to audit both kinds of access should indicate that not only are Exchange’s native tools insufficient but also to reinforce the sensitive nature of mail files in general. Most compliance regulations specify explicit conditions for auditing and reporting on mail box access and with good reason. E-mail systems contain much of the intellectual property and sensitive information in nearly every organization today, large and small.
The Non-Owner Mailbox Access Reporter provides detailed reports on access to mail files and is easy to setup. With historical reporting capabilities, administrators and auditors can see who is trying to gain access to sensitive mail boxes and help improve security by identifying poor security configurations.
Are you auditing Active Directory, logon events and/or mailbox access? What would prompt you to pursue this information in greater detail? Please share your comments below.