02-04-2014 08:39 AM
02-04-2014 08:53 AM
You would have to enable auditing unfortunately.
The only things that EV logs without auditing is....
1. When was the Exchange Mailbox Entry record for them last updated? (Typically last synchronization)
2. When was the Archive last updated (typically last time they archived something)
3. When was an Archive Folder for them last updated (Again, last time they archived something in the folder)
4. Newest item archived based on sent/received date
5. Newest Item archived based on archived date
But for who accessed their vault the last time, you would absolutely need Auditing.
You could probably look through the IIS logs and look for any request that isn't Client.gif
Also auditing will not tell you when the user accessed something through Virtual Vault, it would only recall items being read from like Search.asp, archive explorer, OWA, or through a shortcut in Outlook
http://www.symantec.com/business/support/index?page=content&id=TECH49054
02-04-2014 08:52 AM
Can you clarify what you mean by accessed? Do you mean items added to the archive or just items viewed?
Do you have auditing enabled?
02-04-2014 08:53 AM
You would have to enable auditing unfortunately.
The only things that EV logs without auditing is....
1. When was the Exchange Mailbox Entry record for them last updated? (Typically last synchronization)
2. When was the Archive last updated (typically last time they archived something)
3. When was an Archive Folder for them last updated (Again, last time they archived something in the folder)
4. Newest item archived based on sent/received date
5. Newest Item archived based on archived date
But for who accessed their vault the last time, you would absolutely need Auditing.
You could probably look through the IIS logs and look for any request that isn't Client.gif
Also auditing will not tell you when the user accessed something through Virtual Vault, it would only recall items being read from like Search.asp, archive explorer, OWA, or through a shortcut in Outlook
http://www.symantec.com/business/support/index?page=content&id=TECH49054
02-11-2014 07:49 AM
Hey OP.
Wondering if you had any more outstanding questions related to this posting. If the above answers satisified your expectations for this post please take a second and mark it as resolved so that those trying to help those in need can be easily united with those requiring help.
Thanks in advanced.
J
02-19-2014 06:30 AM
Thank you all