Event Details
User Activity->Object Access->Exchange Object Access->InTrust Plug-in for Exchange->Owner Access->EventID 278 - User copied message in own mailbox.
EventID 278 - User copied message in own mailbox.
 Sample: 
Event Type:     SuccessAudit
Event Source:   InTrust for Exchange
Event Category: Owner mailbox access
Event ID:       278
Date:           11/9/2009
Time:           08:41:07
User:           RESEARCH\ALebovsky
Computer:       DC1
Description:    
User copied message in own mailbox: 

	User Name: ALebovsky 

	User Domain: research.corp 

	Mailbox Name: Alex Lebovsky 

	Client IP: 10.0.0.1 

	Object Name: No subject 

	Object ID: <B2AD45CE3BBC614EB7B3C1AD3510D60B84E9@dc1.research.corp> 

	Source Path: Unknown 

	Target Path: /Inbox 

	Mailbox legacyExchangeDN: /o=Research corp/ou=First Administrative Group/cn=Recipients/cn=Administrator
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: InTrust for Exchange
Filtering Field Equals to Value
Category ITEX:Owner mailbox access
Source InTrust for Exchange
EventId 278
Field Matching
FieldDescriptionStored inSample Value
When At what date and time a user activity originated in the system. DateTime 10.10.2000 19:00:00
Who Account or user name under which the activity occured. User Name ALebovsky
What The type of activity occurred (e.g. Logon, Password Changed, etc.) "Exchange object copied" Exchange object copied
Where The name of the workstation/server where the activity was logged. Computer DC1
Where From The name of the workstation/server where the activity was initiated from. Client IP 10.0.0.1
Severity Specify the seriousness of the event. "Low" Low
WhoDomain -
WhereDomain -
Result Successful or Failed "Successful" Successful
Object Name Object Name No subject
Object Type "Message" Message
Whom -
Comments
You must be logged in to comment