Chat now with support
Chat with Support

Change Auditor 7.0.3 - Quick Start Guide

Make changes in Exchange and run a query

Change the Delivery Options to specify a user to send email on behalf of.
Expand the Shared | Built-In | Recommended Best Practice | Exchange folder in the left pane.
Locate and double-click All Exchange Events in the last 24 hours in the right pane.

Enable Exchange mailbox auditing

To enable Exchange mailbox auditing, you must first define whose mailbox activities (users or groups) are to be audited.

1
Open the Administration Tasks tab.
2
Click Auditing.
3
Select Exchange Mailbox in the Auditing task list to open the Exchange Mailbox Auditing page.
4
Click Add to display the Exchange Mailbox Auditing wizard.
5
If not already selected, select the This Object option at the top of the first page.
6
Click Finish to close the wizard and return to the Exchange Mailbox Auditing page, where your selections will now be listed.
7
If you specified to audit an individual user’s mailbox and you want to audit for ‘by owner’ events, place your cursor in the Events cell, click the arrow controls and select the Owner, Non-Owner option from the drop-down list.
Click on the Status column heading to sort the list by Disabled/Enabled -- bringing the disabled events to the top of the list.
Click in the data filtering cell under the Facility Name heading and start typing Exchange Mailbox Monitoring. As you type, this will filter the list to display only those events included in the Exchange Mailbox Monitoring facility.
Expand the Shared | Built-In | All Events folder in the left pane.
Locate and double-click All Exchange Events in the right pane.

 

Customizing Change Auditor

Now that you are familiar with running searches and viewing the results received, let’s discuss some additional features which allow you to customize what is being audited by Change Auditor and the results you are receiving.

Create a custom search

If you do not see a Built-in Report that suits your needs, it is very easy to create a custom report under the Private or Shared folder in the explorer view (left pane of the Searches page). Private searches are those that only you can run and view, whereas Shared searches can be run and viewed by all Change Auditor users.

3
Click New at the top of the Searches page to display and activate the Search Properties tabs, where you can define the search criteria.

Name your search

Search for events generated by a specific user, computer or group.

By default, Change Auditor searches for events generated by all users, computers and groups.

1
3
Click Add to add criteria to selection list
4
Click Select to save the selection
NOTE: To use a wildcard expression to specify a user or group, expand the Add tool bar button and select Add Wildcard Expression.

Search for events based on subsystem, event class, object class, severity or results.

By default, all entities will be included in a new search definition.

1
4
Click Add to add criteria to selection list
5
Click OK to save selection

Search for events captured by a specific agent or within a specific domain or site.

By default, all agents will be included in a new search.

1
Click Add
3
Click Add to add criteria to selection list
4
Click OK to save the selection
NOTE: To use a wildcard expression to specify a domain, site or agent, expand the Add tool bar button and select Add Wildcard Expression.

Search for events that occurred during a specific date/time range.

By default, new searches will include the events captured this week.

Search for events originating from a specific workstation or server.

By default, Change Auditor searches for all events regardless of where they originated.

1
Click Add
3
Click OK to save the selection
4
Once you have defined the search criteria, click the Run tool bar button from one of the Search Properties tabs to save and run the search.
Related Documents