Change Auditor 7.5 - User Guide

Exchange event logging

Exchange event logging

In addition to real-time event auditing, you can enable event logging to capture Exchange events locally in a Windows event log. This event log can then be collected using InTrust to satisfy long-term storage requirements.

When event logging for Exchange is enabled in Change Auditor, the following types of Exchange events are sent to the InTrust for Exchange event log:

•	ActiveSync events

•	Exchange Mailbox events, including non-owner, owner, permission and protection events

NOTE: Only configured Exchange Mailbox activities are sent to the event log.

•	Public folder events

•	Store mount events

•	System events

•	Exchange Administrative PowerShell events

See the Change Auditor for Exchange Event Reference Guide for a list of the events that can be sent to this event log.

To enable Exchange event logging:

1	Open the Administration Tasks tab.

2	Click Configuration.

3	Select Agent in the Configuration task list to display the Agent Configuration page.

4	Click Event Logging.

5	On the Event Logging dialog, select Exchange.

6	Click OK to save your selection and close the dialog.

Exchange events, including activities associated with the Exchange Mailboxes included on the Exchange Mailbox Auditing list, will then to be sent to the event log.

Exchange Mailbox Protection

Exchange Mailbox Protection

•	Exchange mailbox protection introduction

•	Exchange Mailbox Protection page

•	Exchange Mailbox Protection templates

•	Exchange Protection wizard

Exchange mailbox protection introduction

Exchange mailbox protection introduction

Using mailbox protection, you can prevent unwanted access on critical mailboxes through an Exchange Mailbox Protection template.

NOTE:   • Protection is designed to protect a few high-value mailboxes. • Protection prevents unauthorized users from accessing a protected mailbox through Outlook clients, OWA; it does not prevent access using ActiveSync or permission changes on the mailbox through the Exchange Administration tools. • You can specify users and groups who can access protected mailboxes. • After monitoring has been enabled or changed, it may take several minutes to complete the configuration process necessary to enable protection on the agent. Protecting a large number of mailboxes slows down the configuration process. • Agent processing of Exchange auditing and protection configurations may slow down initial user logon access or cause timeouts if many user logins occur at the same time. To avoid this issue, Quest recommends that changes to mailbox auditing or protection configurations be performed during maintenance intervals or other periods of low user mailbox activity. Before the system is returned to normal load, one user should log in to Outlook Web Access (OWA), and Outlook clients. This triggers the agent to process the Exchange Mailbox auditing and protection configuration changes when the fewest login are occurring.

 

Exchange Mailbox Protection page

Exchange Mailbox Protection page

The Exchange Mailbox Protection page displays when you select Exchange Mailbox from the Protection task list in the navigation pane of the Administration Tasks tab. From this page you can start the Exchange Mailbox Protection wizard to define the mailboxes to protect from unauthorized access. You can also edit existing templates, disable a template, and remove templates that are no longer being used.The Exchange Mailbox Protection page contains an expandable view of all previously defined Exchange Mailbox Protection templates. To add a template to this list, click Add. Once added, the following information is provided for each template:

NOTE: Authorization to use the administration tasks on the Administrations Tasks tab is defined using the Application User Interface page under the Configuration task list. If you are denied access to the tasks on this page, refer to the Change Auditor User Guide for more information on how to gain access.

Template

Displays the name assigned to the template when it was created.

Status

Indicates whether the template is enabled or disabled. To enable/disable the template, place your cursor in this Status cell, click the arrow control and select the appropriate option from the drop-down menu.

Override Accounts

Indicates whether the override accounts listed are excluded from protection or included in protection. This setting corresponds to the option used at the top of the last page of the Exchange Protection wizard:

▪	Excluded from Protection - indicates that you selected the Allow option to allow only the selected accounts to access the protected objects.

▪	Included in Protection — indicates that you selected the Deny option to allow all accounts to access the protected objects EXCEPT for those selected.

Owner Override

Indicates whether the Mailbox owner can bypass protection check box was selected and mailbox owners are allowed to access their own mailboxes.

Mailboxes

This field is used for filtering data.

Override Account Filter

This field is used for filtering data.

 

Click the expansion box to the left of the Template name to expand this view and display the following details for each template:

Exchange Mailbox

Displays the canonical name of the Exchange Mailbox or directory object included in the protection template.

Status

Indicates whether the protection for the mailbox is enabled or disabled.

Name

If applicable, this column shows the display name assigned to the directory object.

Override Account

Displays any accounts that are allowed (or not allowed) to access the protected mailboxes, as specified on the last page of the wizard.

NOTE: This field is not displayed when there are no override accounts specified in the Exchange Protection wizard.