Change Auditor for Exchange 7.4 - User Guide

Exchange event logging

In addition to real-time event auditing, you can enable event logging to capture Exchange events locally in a Windows event log. This event log can then be collected using InTrust to satisfy long-term storage requirements.

When event logging for Exchange is enabled in Change Auditor, the following types of Exchange events are sent to the InTrust for Exchange event log:

NOTE: Only configured Exchange Mailbox activities are sent to the event log.

See the Change Auditor for Exchange Event Reference Guide for a list of the events that can be sent to this event log.

Exchange Mailbox Protection

Exchange mailbox protection introduction

Using mailbox protection, you can prevent unwanted access on critical mailboxes through an Exchange Mailbox Protection template.

NOTE:   • Protection is designed to protect a few high-value mailboxes. • Protection prevents unauthorized users from accessing a protected mailbox through Outlook clients, OWA; it does not prevent access using ActiveSync or permission changes on the mailbox through the Exchange Administration tools. • You can specify users and groups who can access protected mailboxes. • After monitoring has been enabled or changed, it may take several minutes to complete the configuration process necessary to enable protection on the agent. Protecting a large number of mailboxes slows down the configuration process. • Agent processing of Exchange auditing and protection configurations may slow down initial user logon access or cause timeouts if many user logins occur at the same time. To avoid this issue, Quest recommends that changes to mailbox auditing or protection configurations be performed during maintenance intervals or other periods of low user mailbox activity. Before the system is returned to normal load, one user should log in to Outlook Web Access (OWA), and Outlook clients. This triggers the agent to process the Exchange Mailbox auditing and protection configuration changes when the fewest login are occurring.

Exchange Mailbox Protection page

The Exchange Mailbox Protection page displays when you select Exchange Mailbox from the Protection task list in the navigation pane of the Administration Tasks tab. From this page you can start the Exchange Mailbox Protection wizard to define the mailboxes to protect from unauthorized access. You can also edit existing templates, disable a template, and remove templates that are no longer being used.The Exchange Mailbox Protection page contains an expandable view of all previously defined Exchange Mailbox Protection templates. To add a template to this list, click Add. Once added, the following information is provided for each template:

NOTE: Authorization to use the administration tasks on the Administrations Tasks tab is defined using the Application User Interface page under the Configuration task list. If you are denied access to the tasks on this page, refer to the Change Auditor User Guide for more information on how to gain access.

Click the expansion box to the left of the Template name to expand this view and display the following details for each template:

NOTE: This field is not displayed when there are no override accounts specified in the Exchange Protection wizard.