You can cause Microsoft Exchange Server to log an event when a user moves or copies objects from the private or public information store to another store, such as a Personal Folder.
When you implement logging, the following data is logged:
Size of item downloaded
Here is a sample entry:
Event ID: 7102 Type: Information Source: MSExchangeIS Private Category: Download Description: User WinNT_Domain\User (mailbox /o=Org /ou=Site /cn=Recipients /cn=Mailbox) downloaded 2127271 bytes from attachment c7e20a0c4-9762-11d1-a487-00c04fc29f3e-b8a1To implement logging, use Regedt32 to navigate to:
Double-click the MSExchangeIS key.
To log public folder downloads, select ParametersPublic.
To log private mailbox downloads, select ParametersPrivate.
On the Edit menu, Add Value name Log Downloads as a type REG_DWORD.
Set the data value per the following:
To log downloads from Data Attachments only 1 Messages only 2 Attachments and messages 3 Folders only 4 Attachments and folders 5 Messages and folders 6 All 7NOTE: You may add Log Downloads to both ParametersPublic and ParametersPrivate.