I apologize if this is the wrong forum to post this question. Please advise if it is, I will report appropriately.
I have a strong suspicion that someone has been checking my email. When I right click on my notes email DB on the workspace, and goto Properties → Information Tab → User detail, I see this persons name appear.
My question is, would anything else (such as replication, updates from server, etc) other than a direct read cause an entry into the User activity log?
Subject: User activity log - has my email database been compromised?
If your ACL does not show this person as having access then also look to see if there is some sort of Admin Group that has access. The person might be in that group. It could well be a server based agent that is signed by this person. Look to see if it is generally around the same time (scheduled agent).
Also check what your company policy is about email.
Your IT groups (person) would be the first place I would go.
Subject: RE: User activity log - has my email database been compromised?
Thanks for your response Bill, the person is a member of the Administrators. But you mention what I was interested in regarding the agents. The agents all have the same update time stamp of march 05, whil the email reads are the past month
I posted additional info in the above post…any additional thoughts?
Subject: RE: User activity log - has my email database been compromised?
Hi Desean,
I’m quite sure no one is going to check your mail a few times a day, nor once a day. Administrrators have no free time to check user’s mail as you are saying. I believe there is an agent running, and you just can’t see it.
I’m an administrator of a few thousands of users, and I can say I never open someone’s mail to read what a user is sending or receiving. Sometimes management as us to do something like this, for specific purposes. As an administrator, I can say I never delete a mail, and I never send a return receipt, so what you have done is not going to be very usefull.
I propose you to do the most direct way, just go there and ask him.
Subject: RE: User activity log - has my email database been compromised?
Hi Daniel
I appreciate your input and as an administrator of a few thousand users, your point is legitimate. However, we are a company of 30 users, and this person reports directly to me, so its not as if I am just accusing some administrator of being bored. This person’s position is in jeopardy, so I have reason to believe he is checking.
I am trying to find out more about these agents you mentioned. I see them on the Database → Goto Agents.
My ID is setup as administrator. Are there hidden agents that I can only see on the domino server?
He fell into the trap, he was checking my email !!!
As I mentioned earlier, I sent an email to MYSELF (Me to Me) with his name in the title line. Inside was a harshly worded email and a message to CALL ME.
I kicker is I set a delivery confirmation on the email, so if he opened the SENT folder item, it would send a confirmation to my inbox.
Just now, I got a delivery confirmation with his name stamp on it . Activity log shows he opened some emails.
O, and he has since called me 20x in the last 10 min.
Thanks for all your help guys, I got what I needed!!!
Subject: RE: User activity log - has my email database been compromised?
If this is true then you have a real problem and I would suggest that it would be grounds for immediate dismissal. An agent signed by an admin that runs on each DB might be part of corporate policy, but this person is reporting to you so you should know the policy, besides the agent would likely run on a schedule so it would happen at the same time every day.Any Admin that has the rights to read an email DB other than their own ethically should notify the owner of the DB that He/She is doing this and why (generally trying to track down a system problem).
I would confront the person directly and ask him why there are so many reads of your emails with his signature on them. If he can not give a very good answer, then walk him to the front door, take away his keys and disable all of his IDs immediately. For an admin to do this is ethically and morally inappropriate, if not illegal.
Subject: RE: User activity log - has my email database been compromised?
Daniel,
Thanks very much for your response. I have seen the location before. He is a member of the Administrators group and is listed there, so he can definitely check.
This person actually now reports to me as a network admin and I suspect he is looking at other emails for other people as well.
Here is some more information. In the user activity log this past month, there are about 100 Reads, a few writes. Meaning if my suspicions are true, he check a few times a day.
I know nothing about Agents, but have taken a look at Database-> Goto Agents. What I see is almost all are manual set, as ide from the Menu ones. Regardless of that, the last date any agent was modified was a year and a half ago (March 05). The email checks are a few times a day this past month. Does this eliminate the signing agent possibility?
Given this information, do you have any additional thoughts?
In my email DB, I sent myself a email with the subject line Re: His Name. If he is checking, I know he won’t be able to resist this one! Basically, it is a nasty email saying he is busted. I set up return receipt and am hoping I will get a read confirmation when he checks my email. I also disabled delete capability for the Administrator so I should be able to bust him? Hopefully.
If anyone has any other suggestions, please advise I really want to nail this slimeball!