How can I enable logging of user access to another user's mailbox?

A. If you've delegated permissions so that a user can open another user's mailbox and you want to audit this type of activity, you need to enable at least a minimum level of diagnostic logging. To do so, perform these steps:

Now when a user accesses another user's mailbox, an event ID 1016 is written to the Application event log that shows who accessed which mailbox, as the figure shows.In the FAQ " How can I trigger an action to be performed when certain Windows events occur?" (http://www.windowsitpro.com/Article/ArticleID/46008/46008.html ), I explained how to use Eventtriggers to trigger actions based on certain event logs. You could therefore use a trigger to activate an action based on event ID 1016 in the Application event log. For example, to start a script called mailboxaccess.vbs use this command:

C:>eventtriggers /create /tr "Non-Owner Mailbox Access" /eid 1016 /l application /tk c:scriptsmailboxaccess.vbs

The mailboxaccess.vbs script can contain any actions that you desire (e.g., send an email, page someone).