Chat now with support
Chat with Support

Change Auditor for Exchange 7.3 - User Guide

Exchange Mailbox Auditing

Introduction

Exchange mailbox auditing helps tighten enterprise-wide change and control policies by tracking user and administrator activity such as user account changes, delivery restriction changes, send on behalf updates, and more. With these real-time alerts and in-depth analysis and reporting capabilities, your Exchange infrastructure is always protected from exposure to suspicious behavior or unauthorized access and kept in compliance with corporate and government standards.

Before the system is returned to normal load, one user should log on to Outlook Web Access (OWA), Outlook (Outlook for Mac) clients. This triggers the agent to process the mailbox auditing and protection configuration changes when the fewest logins are occurring.

If necessary, you can disable forcing Outlook reconnections on a server-by-server basis. Contact Quest Technical Support for additional information.

To enable mailbox auditing, you define a mailbox auditing list that contains the directory objects whose mailbox activities you want to audit. Change Auditor for Exchange generates shared mailbox events for shared mailbox, room and equipment resources, and for any other mailboxes that the user has identified as shared. See the Managing Shared Mailboxes appendix for more information.

In Change Auditor, some mailbox events are disabled by default due to the potentially high volume of events that can occur. To captured these events, enable them using the Audit Events page of the Administration Tasks tab.

To avoid generating these events, do not add the user account for the mailbox to be moved to the list on the Exchange Mailbox Auditing page on the Administration Tasks tab.

Exchange Mailbox Auditing page

The Exchange Mailbox Auditing page contains a list of the directory objects whose mailboxes are to be audited. If a directory object is not listed on this page, its mailbox will not be audited. To add a directory object to this list, click Add. Once added, the following information is displayed:

To change this setting, place your cursor in this cell, click the arrow control, and select Yes to exclude the directory object or No to include the directory object in the auditing process.
To change this setting, place your cursor in this cell, click the arrow control, and select Enabled to enable the audit object or Disabled to disable the audit object.

Exchange Mailbox Auditing list

The Exchange Mailbox Auditing list contains a list of the directory object’s whose Exchange Mailbox is to be either included or excluded in the auditing process. Click Add to include a mailbox in the auditing process or use the Add | Exclude toolbar option to exclude a mailbox from the auditing process.

2
Click Auditing.
3
Select Exchange Mailbox (under Applications).
4
Click Add to display the Exchange Auditing Wizard.
5
Select one of the options at the top of the page: Enterprise or This Object (default).
6
If the This Object option is selected, use the Browse and Search pages to locate and select a directory object (for example, User, Group, Container, DomainDNS, OrganizationalUnit, or BuiltinDomain) and use the Add button to add the selected directory object to the Selected Object list at the bottom of the page.
7
Click Finish to close this wizard and return to the Exchange Mailbox Auditing page, where your selections are listed with a No in the Exclude cell.
Place your cursor in the Exclude cell of the mailbox to include, click the arrow control, and select No.
For individual user mailboxes, you can change this to include ‘By Owner’ events as well. To do so, place your cursor in the Events cell, click the arrow control, and select the Owner, Non-Owner option from the list.
9
The default scope of coverage is displayed in the Scope cell. You can change this by placing your cursor in the Scope cell, clicking the arrow control and selecting the appropriate option from the list:
2
Click Auditing.
3
Select Exchange Mailbox (under Applications in the Auditing task list) to open the Exchange Mailbox Auditing page.
4
Expand Add and click Exclude to display the Exchange Auditing Wizard.
5
Select one of the options at the top of the page: Enterprise or This Object (default).
6
If the This Object option is selected, use the Browse and Search pages to locate and select a directory object (for example User, Group, Container, DomainDNS, OrganizationalUnit, or BuiltinDomain) and click Add to add the selected directory object to the Selected Object list at the bottom of the page.
7
Click Finish to close this wizard and return to the Exchange Mailbox Auditing page, where your selections are listed with a Yes in the Exclude cell.
NOTE: From the Exchange Mailbox Auditing page, you can exclude a previously included mailbox by changing the setting in the Exclude cell. Place your cursor in the Exclude cell of the mailbox to include, click the arrow control, and select Yes.

For example, if you wanted to audit all mailboxes in the Enterprise, except those belonging to the accounts in the ExchangeAdmin organizational unit, you would create two entries in the Exchange Mailbox Auditing list:

Use Add to create an audit entry for the Enterprise with Exclude = No.
Use Add | Exclude to create an audit entry for the ExchangeAdmin OU with Exclude = Yes.)

The disable feature allows you to temporarily disable the audit entry of a directory object without having to remove it from the Exchange Mailbox Auditing list.

1
On the Exchange Mailbox Auditing page, place your cursor in the Status cell for the Exchange mailbox whose auditing you want to disable, click the arrow control and select Disabled
The entry in the Status column for the object changes to ‘Disabled’.
2
To re-enable the auditing of a directory object’s mailbox, use the Enable option in either the Status cell or right-click menu.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating