One of our techs believes his Notes ID has been compromised. The only way it could have been comprimsed is if someone with the same access to the archives used it. Is there a way to track activity on a mailbox? User Detail won’t help because the spy is using the user’s Notes id and logging in as the tech. We would just be able to compare date and time of reads/writes.Any tool we could use?
Any help is appreciated.
Subject: Another thing you could do…
…recertify the tech, and then turn on ‘compare Notes public keys…’ It’s a setting on the server document - security tab, sectiono ‘Security Settings’. You’ll also find the ‘check passwords on Notes id’s’ there.
Security Settings
Compare Notes public keys against those stored in Directory:
Yes
Subject: Who is using my Notes ID?? Way to find out??
First off, change tech’s password and turn on password checking on the server. This will stop nasty person using the id with the old pw.
Second (in answer to your main question): i dunno. Sorry.
Subject: RE: Who is using my Notes ID?? Way to find out??
Look at the tech’s person document in the Domino directory. If you check the “Notes client machine” field (Administration tab), this will at least tell you which machines this user has been logged in from.
Subject: Administrator client…
…that’s a smart idea. Maybe give the ‘compromised’ tech a fixed IP address, that would make it easy to track logins from other ip addressed.
Subject: RE: Who is using my Notes ID?? Way to find out??
Those fields are empty…Should there be a setting to turn that on? The only one I’m familiar is the password check…
Subject: RE: Who is using my Notes ID?? Way to find out??
The ‘Notes Client Machine’ is only populated via the Admin P process when a code upgrade has been performed on the end user machine.
The only way I think of capturing the person using the ID file is to capture the IP or MAC address of the incoming request of the ID file.
Apart from that I suggest that the user uses the ‘compromised password’ button in the User security under File → Security → user security, and updating the public keys and changing the digital signature.
Subject: Who is using my Notes ID?? Way to find out??
another option would be to use Admin client. Go to Server / Status / Database Users and see what IP addresses they’re coming in from. You also might check Internet Users, too. The other options here help prevent the person from using the ID but I would think you want to know who it is first so they can be dealt with.
Subject: RE: Who is using my Notes ID?? Way to find out??
Thank you for your advise. That view lists all notes id acessing all databases, but if the id culprit switches to the tech’s id, then the culprit’s name won’t show up in that view.