If you have a lot of users and your server is heavily loaded, then maybe you should watch mailbox.log for ModifyPrefs (check tour log for exact message) and scan just those accounts. We don't bother. Running raw ldapsearch (without the zmprov ga Java overhead) is fast enough that we can search all accounts every few minutes. A terse account of other things we do is at: http://www.sans.org/reading_room/whitepapers/email/phishing-detecton-remediation_34082
|