Change Auditor for Exchange 7.0.1 - Event Reference Guide

Introduction Change Auditor for Exchange Events

Exchange ActiveSync Monitoring Exchange Administrative Group Exchange Distribution List Exchange Mailbox Monitoring Exchange Organization Exchange Permission Tracking Exchange User

Log Events

InTrust for Exchange event log

Non-Owner Mailbox Access events Owner Mailbox Access events Mailbox Permission events Public Folder event Mailbox Protection events Store Mount events System events PowerShell cmdlet event ActiveSync events

Notes for Change Auditor for Exchange Events

Owner Mailbox Access events

The following table lists owner mailbox access events that are recorded to the InTrust for Exchange event log.

Table 9. InTrust for Exchange event log: Owner Mailbox Access events
Event ID	Description
264	Message received in mailbox
273	User created message in own mailbox
274	User deleted message from own mailbox
275	User moved message in own mailbox
276	User read message within own mailbox
277	User modified message in own mailbox
278	User copied message within own mailbox
529	User created note in own mailbox
530	User deleted note from own mailbox
531	User moved note in own mailbox
532	User read note within own mailbox
533	User modified note in own mailbox
534	User copied note within own mailbox
785	User created task in own mailbox
786	User deleted task from own mailbox
787	User moved task from own mailbox
788	User read task within own mailbox
789	User modified task in own mailbox
790	User copied task within own mailbox
1041	User created appointment in own mailbox
1042	User deleted appointment from own mailbox
1043	User moved appointment from own mailbox
1044	User read appointment within own mailbox
1045	User modified appointment in own mailbox
1046	User copied appointment within own mailbox
1297	User created journal entry in own mailbox
1298	User deleted journal entry from own mailbox
1299	User moved journal entry in own mailbox
1300	User read journal entry within own mailbox
1301	User modified journal entry in own mailbox
1302	User copied journal entry within own mailbox
1553	User created folder in another user’s mailbox
1554	User deleted folder from own mailbox
1555	User moved folder in own mailbox
1556	User read folder within own mailbox
1557	User modified folder in own mailbox
1558	User copied folder within own mailbox
1809	User created contact in own mailbox
1810	User deleted contact from own mailbox
1811	User moved contact in own mailbox
1812	User read contact within own mailbox
1813	User modified contact in own mailbox
1814	User copied contact within own mailbox
2065	User created distribution list in own mailbox
2066	User deleted distribution list from own mailbox
2067	User moved distribution list in own mailbox
2068	User read distribution list within own mailbox
2069	User modified distribution list in own mailbox
2070	User copied distribution list within own mailbox
2321	User created post in own mailbox
2322	User deleted post from own mailbox
2323	User moved post in own mailbox
2324	User read post within own mailbox
2325	User modified post in own mailbox
2326	User copied post within own mailbox
2577	User created generic type object in own mailbox
2578	User deleted generic type object from own mailbox
2579	User moved generic type object in own mailbox
2580	User read generic type object within own mailbox
2581	User modified generic type object in another user’s mailbox
2582	User copied generic type object in own mailbox

Mailbox Permission events

The following table lists the events relating to mailbox permissions that are recorded to the InTrust for Exchange event log.


	NOTE: On Exchange 2010 and 2013, these events are generated by a Microsoft® PowerShell command; therefore, a generic PowerShell cmdlet event (Event ID 2304) is logged to the event log. See PowerShell cmdlet event.

Table 10. InTrust for Exchange event log: Mailbox Permission events
Event ID	Description
200	User modified folder permissions in another user’s mailbox
201	User modified folder permissions in owner mailbox This event is generated even when owner mailbox auditing is not enabled. For more information, see Note 16 .
210	User assigned a delegate for own mailbox
211	User removed a delegate for own mailbox
212	User modified delegate’s permissions for own mailbox
213	User assigned a delegate for another user’s mailbox
214	User removed a delegate for another user’s mailbox
215	User modified delegate’s permissions for another user’s mailbox

Public Folder event

The following table lists the event relating to Public Folders that are recorded to the InTrust for Exchange event log.

Table 11. InTrust for Exchange event log: Public Folder event
Event ID	Description
216	User modified public folder permissions

Mailbox Protection events

The following table lists the events relating to mailbox protection that are recorded to the InTrust for Exchange event log.

Table 12. InTrust for Exchange event log: Mailbox Protection events
Event ID	Description
501	Change Auditor for Exchange Service failed to load the protection configuration
502	Change Auditor for Exchange Service successfully updated the protection configuration
503	Failed attempt to logon to the protected mailbox

Please select your product:

To serve you better, please complete the Purpose of your Chat:

Recommended Solutions for Your Problem

Change Auditor for Exchange 7.0.1 - Event Reference Guide

Owner Mailbox Access events

Mailbox Permission events

Public Folder event

Mailbox Protection events