Can an exchange administrator read email form users accounts (without the users knowledge)? Are there mechanisms in place to prevent this? If so what are they? I always assumed an admin would need to 'take possession' of the account or file in order to read the email and then the user would be aware someone had read their stuff. Similiarly, if an admin changes the user PW in order to access the email acocunt, the user would know because the PW changed. Does it work that way in exchange? (I need to explain to bosses why they can trust a move to the exchange email server in regards to their paranoid privacy needs)

What version of Exchange? Exchange 2010? What mechanisms are in place? By default, admins do not have rights to user mailboxes. Yes, you might say, but an admin can grant access to himself (FULL access among others). Correct, but in Exchange 2010, all underlying Powershell commands to this effect would be logged. Yes, the admin could empty the logs, or disable logging, but this would be suspicious. If you just have one admin, they might be able to get away with that because it is unlikely that the bosses would know where to look for this stuff. If you have two or more admins, that is more difficult (unless they all agree to secretly observe the correspondence of their superiors). Other options would leave traces as well: Transport Rules forwarding a copy of the bosses email to another mailbox and so forth. Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you.

Exchange admin can easily read emails from user accounts without the end user knowledge. Exchange admin does not need to change the password for any user in order to access his mailbox. Exchange admin can simply assign full mailbox access on the user mailbox and he can access the mailbox. Exchange has inbuilt feature of journaling and you can also setup a transport rule to bcc to exchange admin mailbox or any other mailbox. Let me know if you need any more clarification on thisPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. Hasnain Shaikh| My blogs: http://messagingserversupport.com

I always assumed an admin would need to 'take possession' of the account or file in order to read the email and then the user would be aware someone had read their stuff. No, it's a simple matter of adjusting permissions and the user would NOT be aware. But the changing of permissions would be logged, at least in E2K10 SP1. Similiarly, if an admin changes the user PW in order to access the email acocunt, the user would know because the PW changed. Does it work that way in exchange? You are correct there. Note that you could implement encryption (SMIME for example) and somehow arrange it so admins do not have access to the keys (maybe bring in outside consultant) but that creates quite a bit of complexity. What is the concern? That admins would just be nosy (curious) or actually give or sell information to a competitor? In the second case, you could have them sign confidentiality documents - possibility of legal action often encourages discretion. *** *** Some more information: http://technet.microsoft.com/en-us/library/dd335144.aspx A recent discussion: http://social.technet.microsoft.com/Forums/en-US/exchangesvradmin/thread/d12f9234-cd10-4139-98d9-2ff6f122041f Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you.

Thanks for the replies. I guess we go to using encrypted attachments for communications they are concerned about. Thanks again.

Exchange admin can easily read emails from user accounts without the end user knowledge. Exchange admin does not need to change the password for any user in order to access his mailbox. Exchange admin can simply assign full mailbox access on the user mailbox and he can access the mailbox. Exchange has inbuilt feature of journaling and you can also setup a transport rule to bcc to exchange admin mailbox or any other mailbox. Let me know if you need any more clarification on thisPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. Hasnain Shaikh| My blogs: http://messagingserversupport.com