We have several users using a shared account and when messages in that account's in box have been processed they are drag and dropped into a public folder. Is there a way to determine who dropped a mail item in an Exchange 2003 public folder, so that we can have some accountability?
I suspect this can't be done natively in Exchange, so if there is a scripted solution to this I'd be very interested.
You may have luck examining the PR_CREATOR_NAME and PR_LAST_MODIFIER_NAME MAPI properties on the items. You can use the MDBVU32 utility to view these properties (background on doing that is available in KB253291).
On my test machine (a Customer's E2K3 server I had close at-hand), though, I found that items I copied from my "Inbox" folder to a public folder did not bear a modified PR_CREATOR_NAME or PR_LAST_MODIFIER name different from the original sender. Your mileage may vary.
If it came be done, it would be located by going to Exchange System Manager > Expand Servers > Right click on your server and go to Properties > Diagnostics Logging tab > MSExchangeIS > Public Folders. I don't recall which one does it, either General or Access Control, maybe Views. Unfortunately it doesn't put it into a log file. It shows up in the application log.