rule creation history

[Paul Iskander]

I need to track the history of a rule that was created on a users computer by
another user to move items to deleted without being read. The computer was
left unlocked during a break. We are trying to get the date/time the rule was
created to help catch the offender.
Is there a way to track when a rule was created in Outlook 2000 on Exchange
Server 2000 Advanced SP3?
Thank You
Reply to : (e-mail address removed) please

 

[Roady [MVP]]

No.

 

[F. H. Muffman]

No.

Unless the admin was pyschopathically meticulous and cranked up *all* the
logging a long time ago, including the Rules logging, then you'd just have
to dig through the obscenely huge event log to find when the rule first
started firing. =)

I used to crank up all the logging and regularly save out event logs... just
because. Disk space is cheap and it wasn't something I'd mind losing, so I
tended to save data like that. If the drive went south, it went south and
I'd start over.

Tho, considering the admins that would do that can probably be added up on a
drunk carpenter's hand, I think Roady's answer is probably right in your
case. The user isn't able to say how long its been since they got mail?
Do they empty their deleted items regularly? It should be pretty easy to
get a time frame, I'd think. Good Sherlock Holmes area.

 

[Roady [MVP]]

Enabled all the logging? That server must be a test server then or heavily
overspecced as it would be a killer on performance in a live environment ;-)

 

[F. H. Muffman]

Enabled all the logging? That server must be a test server then or heavily
overspecced as it would be a killer on performance in a live environment
;-)

Always over-spec. =)

And heck, if it's slow out of the box, everyone will assume it's normal =)

 

[Roady [MVP]]

Definitely! Always secretly disable at least one processor on a server. Then
when your boss comes telling you that you need to look into the performance
of the server, you just sit around playing games all day and just before you
go home you enable the processor and tell him you fixed it. He'll praise
your tweaking skills for weeks! :-D