Access Employee Emails

MoneySavingWantTo

Hi all,

Long time reader but none poster until now. I hope someone can help. We suspect an employee of fraudulent activity having being tipped off by a customer about an email that in essence suggests money is paid into the wrong account. A problem was had with this some time ago but appeared one off and due to human error and wasnt followed up. Now we are not so sure. Anyway, I think from employment law point of view we (i.e. director) can open up the work email of the user to investigate but without letting them know. Can anyone explain how I go about this on Small Business Server? I am the administrator but dont know how to access the email.

Ideally I want to gather evidence before giving it to the police but obviously dont want to tip the person off and give opportunity to remove it!

Thank you

kingmonkey

More info required. Contact your systems administrator.

tronator

...or contact your company's lawyer first. If the employees are allowed to use the email system for personal emails too, then you you're not allowed to read his email without his knowledge.

bod1467

It all depends on what T&Cs of employment are in place, codes of practise etc. My company's rules include a clause about the company retaining the right to monitor emails (addresses and content).

What email client is being used? Outlook?
Are emails stored on the server or downloaded to local storage files? (Like PST files).

MoneySavingWantTo

Hi. Thank you for your replies. Legally we are fine. Both employment contract states business email address can only be used for business purposes and also, having consulted with our solicitor, suspicion of fraud is justification for viewing if we can prove it (which we can). It is now an exercise of uncovering the severity of the problem.

We are on SBS 2011 and use microsoft exchange. I think a copy is stored on the server. I am the administrator of the network but as you can probably tell I am not that technically minded but have some knowledge and would rather avoid paying a consultant to come in unless absolutely necessary. Ideally need a way to copy mail box in full for viewing on another computer (can I download the .pst and upload to outlook locally and with the administrator password?) or view suspects mail box but without them knowing so they cannot delete evidence?

Thank you

getmore4less

You should have the system set up based on a retention policy to keep all business communication even if individual employees delete them.

You should also have other ways to track money flows and cross checks that catch things like this.

Independent of this particular requirement you need to get your policies and procedures tightened up and make sure that access to all business communications in and out are searchable.

System

Tongue-in-cheek response.

Rebekah Brookes or Andy Coulson could probably help you as they seem to know people who can access comms systems easily

MoneySavingWantTo

getmore4less wrote: »

You should have the system set up based on a retention policy to keep all business communication even if individual employees delete them.

You should also have other ways to track money flows and cross checks that catch things like this.

Independent of this particular requirement you need to get your policies and procedures tightened up and make sure that access to all business communications in and out are searchable.

Hi thank you.

I am not sure about the email retention but will look into it.

We do track money flows and this or any other event would have been picked up when the transaction occurred. It is very unlikely this would have gone unnoticed (to the point that I cant believe the stupidity in the method to be honest) but in this case we were tipped off before the event by a company we have worked with for many years. I think the risk of financial loss is low given our systems but you cannot legislate for an employee trying their luck unfortunately.

It is how I now going about checking your last statement to see what I can access and what not. Unfortunately not a huge company with IT departments etc who can assist.

bod1467

Regarding the PST file ... if the user has a password-protected PST file then you may need to know the password to be able to open it.

But in principle you can copy a PST file and then open it in Outlook. (File | Open | Outlook Data File ... browse to where the PST copy has been stored)).

MoneySavingWantTo

bod1467 wrote: »

Regarding the PST file ... if the user has a password-protected PST file then you may need to know the password to be able to open it.

But in principle you can copy a PST file and then open it in Outlook. (File | Open | Outlook Data File ... browse to where the PST copy has been stored)).

Thank you. This is what I was thinking but is where my knowledge stops. Where is this stored? On the individuals pc or server or both? Please could someone give me the path that I will find this on the server or pc? thank you

ltrent

If its SBS then you wont have a pst file to find, instead use webmail, goto Internet Explorer from your own office computer and in the address bar type in http://SERVERNAME/exchange or maybe http://SERVERNAME/owa - server name is obviously the name of your server, from there you will be able to log into the webmail as that user and see the inbox and sent items, bare in mind though that if an email is marked as unread and you open it, it will show as read on their computer, which may make them suspicious, assuming you don't want them to know.