Chat now with support
Chat with Support

Change Auditor 7.2 - Quick Start Guide

Make changes in Exchange and run a query

1
Create a new test user with an Exchange mailbox.
2
Make some changes to the test user just created. For example:
•
Create a new alternate SMTP address (e.g., alternate@yourcompany.com).
•
Create a new primary SMTP address (e.g. primary@yourcompany.com).
•
Set the address created above as the primary SMTP address.
•
Change the Delivery Options to specify a user to send email on behalf of.
3
Make some additional changes to Exchange. For example:
•
Add a new filter to catch emails sent from spam@spam.com.
•
Create a new Administrative Group called ‘Test’.
4
Launch the Change Auditor client and run the ‘All Exchange Events in the last 24 hours’ report to view the events generated from the changes made above.
•
Open the Searches tab.
•
Expand the Shared | Built-In | Recommended Best Practice | Exchange folder in the left pane.
•
Locate and double-click All Exchange Events in the last 24 hours in the right pane.
This will display a new Search Results page displaying the events.

Enable Exchange mailbox auditing

To enable Exchange mailbox auditing, you must first define whose mailbox activities (users or groups) are to be audited.

To define an Exchange mailbox auditing list:
1
Open the Administration Tasks tab.
2
Click Auditing.
3
Select Exchange Mailbox in the Auditing task list to open the Exchange Mailbox Auditing page.
4
Click Add to display the Exchange Mailbox Auditing wizard.
5
If not already selected, select the This Object option at the top of the first page.
Use the Browse and Search pages to locate and select a directory object (i.e., User, Group, Container, DomainDNS, OrganizationalUnit, BuiltinDomain) and click the Add button to add the selected object to the Selected Object list at the bottom of the page.
Repeat this step until you have selected all the directory objects you want added to the Exchange Mailbox Auditing list.
6
Click Finish to close the wizard and return to the Exchange Mailbox Auditing page, where your selections will now be listed.
7
If you specified to audit an individual user’s mailbox and you want to audit for ‘by owner’ events, place your cursor in the Events cell, click the arrow controls and select the Owner, Non-Owner option from the drop-down list.
8
In addition, some of the Exchange Mailbox Monitoring events are disabled by default due to the potentially high volume of events that can occur. If you want to capture any of these events, you will need to enable them.
•
Open the Administration Tasks tab and open the Audit Events page (select Audit Events under the Auditing task list).
•
Locate the Exchange Mailbox Monitoring events to be enabled. You can sort the event list in one of the following ways:
•
Click on the Status column heading to sort the list by Disabled/Enabled -- bringing the disabled events to the top of the list.
•
Click in the data filtering cell under the Facility Name heading and start typing Exchange Mailbox Monitoring. As you type, this will filter the list to display only those events included in the Exchange Mailbox Monitoring facility.
•
If there is a specific event, click in the data filtering cell under the Event Class heading and start entering the name of the event. As you type, this will filter the list to include only those events that match the characters entered.
•
Select the entry to be enabled and click the Enable tool bar button.
9
To test the Exchange Mailbox Monitoring events, open Outlook and perform various mailbox activities for any of the users included in your Exchange Mailbox Auditing List.
10
Go back to the Change Auditor client and run the All Exchange Events report.
•
Open the Searches tab.
•
Expand the Shared | Built-In | All Events folder in the left pane.
•
Locate and double-click All Exchange Events in the right pane.
This will display a new Search Results page displaying the events.

 

Customizing Change Auditor

Now that you are familiar with running searches and viewing the results received, let’s discuss some additional features which allow you to customize what is being audited by Change Auditor and the results you are receiving.

•
Create a custom search
•
Group and filter data
•
Create a Change Auditor events list
•
Exclude accounts from auditing

Create a custom search

If you do not see a Built-in Report that suits your needs, it is very easy to create a custom report under the Private or Shared folder in the explorer view (left pane of the Searches page). Private searches are those that only you can run and view, whereas Shared searches can be run and viewed by all Change Auditor users.

1
Open the Searches page.
2
In the explorer view (left pane), expand and select the folder where you want to save your search.
3
Click New at the top of the Searches page to display and activate the Search Properties tabs, where you can define the search criteria.
See the table below for a brief description of the tabs available and how to define search criteria. For more detailed information, refer to the Change Auditor User Guide.
 
Table 3. Search Properties tabs used to define search criteria
Tab
Description
How to add criteria
Info

Name your search
1
Enter name
2
Optionally enter description
Who

Search for events generated by a specific user, computer or group.

By default, Change Auditor searches for events generated by all users, computers and groups.
1
Click Add
2
Select the user/computer/group
3
Click Add to add criteria to selection list
4
Click Select to save the selection
NOTE: To use a wildcard expression to specify a user or group, expand the Add tool bar button and select Add Wildcard Expression.
What

Search for events based on subsystem, event class, object class, severity or results.

By default, all entities will be included in a new search definition.
1
Click Add
2
Use drop-down menu to select an entity
3
Select scope, actions and/or entity (depending on dialog)
4
Click Add to add criteria to selection list
5
Click OK to save selection
Where

Search for events captured by a specific agent or within a specific domain or site.

By default, all agents will be included in a new search.
1
Click Add
2
Select the agent, domain, or site
3
Click Add to add criteria to selection list
4
Click OK to save the selection
NOTE: To use a wildcard expression to specify a domain, site or agent, expand the Add tool bar button and select Add Wildcard Expression.
When

Search for events that occurred during a specific date/time range.

By default, new searches will include the events captured this week.
1
Check date interval option and enter dates
2
Optionally enter time interval
Origin

Search for events originating from a specific workstation or server.

By default, Change Auditor searches for all events regardless of where they originated.
1
Click Add
2
Enter a wildcard expression to search for a workstation or server
3
Click OK to save the selection
4
Once you have defined the search criteria, click the Run tool bar button from one of the Search Properties tabs to save and run the search.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating