Since this attribute is an un-monitored attribute, it will have to be first added to the monitored attributes list. Follow the steps below to accomplish this.
Enabling the attribute:
- Select “Attributes” in the Auditing section of the Administration Tasks tab in the Change Auditor Console
- Highlight “User” in the Schema Class section on the right pane
- Search for or enter a keyword to find the attribute in the Unmonitored attribute List Box on the left
- Highlight the attribute and click the “Add” button to move it to the Monitored Attributes List Box on the right.
- Select the “Search” tab
Configuring the search
- Click on the "What" tab of the Search Properties
- Click the “Drop Arrow” next to the "Add" button and select "Subsystem | Active Directory..."
- Click OK
- On the What tab of the Search Properties, click the drop arrow next to the "Add" button and select "Event Class"
- Search for or type a keyword in the EventClass filter until the msExchHideFromAddressLists is visible.
- Click the "Add" button and click OK
- Save and Run the Search