Change Auditor 7.5 - User Guide

Change Auditor for Exchange Overview

Change Auditor for Exchange Overview

•	Introduction

•	Deployment requirements

•	Client components and features

Introduction

Introduction

Change Auditor for Exchange proactively audits the activities taking place in your entire Exchange environment, then provides real-time, detailed alerts about vital changes that occur. It provides extensive, customizable auditing and reporting capabilities for all critical changes, including those made to administrative groups, mailbox policies, public and private information stores, ActiveSync mailbox policies, and distribution lists. Continually being in-the-know helps you to prove compliance, drive security, and improve uptime while proactively auditing changes to Exchange Server configurations and permissions.

The Exchange Mailbox auditing feature helps tighten enterprise-wide change and control policies by tracking user and administrator activity such as user account changes, delivery restriction changes, send on behalf updates, and more. With these types of real-time alerts and in-depth analysis and reporting capabilities, your Exchange infrastructure is protected from exposure to suspicious behavior or unauthorized access and kept in compliance with corporate and government standards.

In addition to Exchange Mailbox auditing, you can protect and lock down critical mailboxes from unauthorized or accidental access.

NOTE: Exchange auditing, including Exchange Mailbox auditing and protection are only available if you have licensed Change Auditor for Exchange. If you do not have a valid license you can use the features, however, associated events are not captured and protection is not applied. To verify that it is licensed, right-click the coordinator icon in the system tray and select Licensing.

Change Auditor for Exchange also allows you to audit the activities taking place in the Microsoft 365 Exchange Online organization. For details see the Change Auditor for Microsoft 365 and Microsoft Entra ID Auditing User Guide.

•

•

Deployment requirements

Deployment requirements

For a successful deployment, ensure that your environment meets the minimum system requirements. For information about Change Auditor system requirements, see the Change Auditor Release Notes. For details on installing Change Auditor, see the Change Auditor Installation Guide.

Client components and features

Client components and features

The following table lists the client components and features that require a valid Change Auditor for Exchange license. You are not prevented you from using these features; however, associated events or protection are not captured or enforced unless the proper license is applied.

NOTE: To hide unlicensed Change Auditor features from the Administration Tasks tab (including unavailable audit events throughout the client), select Action | Hide Unlicensed Components. This is only available when the Administration Tasks tab is the active page.

 

Table 1. Change Auditor for Exchange client components and features

Client Page	Feature
Administration Tasks Tab	Agent Configuration: • Configuration Setup Dialog - Exchange Tab ▪ Discard duplicates that occur within nn seconds • Event Logging - enable/disable Exchange event logging NOTE: See Exchange Settings and Event Logging (Agent Configuration Page) for information about viewing and modifying the agent configuration setting and enabling event logging. Audit Task List: • Exchange Mailbox NOTE: See Exchange Mailbox Auditing for information about including mailboxes for Exchange Mailbox auditing and Shared Mailbox auditing. Protection Task List: • Exchange Mailbox NOTE: See Exchange Mailbox Protection for information about creating and maintaining Exchange Mailbox Protection templates.
Event Details Pane	What Details: • Class (Exchange) • Object (Exchange) NOTE: See Exchange Searches and Reports for details on additional information.
Events	Facilities: • Exchange ActiveSync Monitoring • Exchange Administrative Group • Exchange Distribution List • Exchange Mailbox Monitoring • Exchange Organization • Exchange Permission Tracking • Exchange User
Search Properties	What Tab: • Subsystem | Exchange NOTE: See Exchange Searches and Reports for information about creating custom Exchange search queries.
Searches Page	Built-in Reports: • All reports that include the events in the Exchange facilities.
Alert Custom Email Dialog	• Add Users - When selected, alerts for user object changes are sent to the user; alerts for mailbox objects are sent to the mailbox owner. • Add Managers - When selected, alerts for user object changes are sent to the user manager (if set); alerts for group objects are sent to the managed-by user (if set). Alerts for mailbox objects are sent to the owner's manager (if set).