How to configure Excluded Accounts in Change Auditor (4372222)

Events can be excluded by type (Facility). It is more efficient to exclude by Facility when excluding numerous events in the same Facility. Use "Exchange Mailbox Monitoring" for mailbox access events, and "Custom File System Monitoring" for file system events. These are the two most excluded Facilities because of the potential to generate the most events, however, any Facility or all Facilities can be excluded using the following steps.

1. Start the Change Auditor Client.
2. Open the client’s Administration view.
3. Open the Auditing menu.
4. Open the Excluded Accounts page.
5. Add a new Excluded Accounts template. The Excluded Accounts Wizard will appear.
6. Enter a Template Name.
7. Under Facility, locate the Facility you want to exclude events from (For example, for Mailbox events use "Exchange Mailbox Monitoring"). Click on any entry with that facility name.
8. Press the Add button, and select “Add All Events in Facility”.
9. Press the Next button.
10. Select the account(s) to be excluded and press the Add button.
11. Press the down arrow on the Finish button, and select “Finish and Assign to Agent Configuration”.
12. The Configuration Setup wizard will appear. The new Account Exclusions template should appear in the templates list and should be enabled.
13. Change the Assigned column for the Account Exclusions template to “Yes” and press the OK button.
14. Ensure that agents in the list that are located on Exchange mailbox servers have the Exclude Account column marked with “Yes”.