Chat now with support
Chat with Support

Unified Communications Analytics 8.6.1 - Deployment Guide

Prerequisites for your installation Installing UC Analytics Configuring UC Analytics Adding data sources for Active Directory or Azure Active Directory Adding data sources, chargeback costs, and thresholds for Exchange and Exchange Online
Permissions needed to collect Exchange on-premises or hybrid data Permissions needed to collect from native Exchange Online Creating an Exchange Configuration data source Creating an Exchange Tracking Logs data source Creating an Exchange Mailbox Contents data source Do I need both Exchange Tracking Logs and Exchange Mailbox Contents collections? Creating an Exchange IIS Logs data source Creating an Exchange Mailbox Content Summary data source Creating an Exchange Calendar data source Creating an Exchange Public Folders data source Adding Exchange Online hybrid data sources for hybrid Office 365 Adding Exchange Online data sources for native Office 365 Setting chargeback costs for Exchange Setting thresholds for Exchange metrics Omitting words when filtering by subject or body
Adding data sources, chargeback costs, and thresholds for Skype for Business/Lync Adding data sources, chargeback, and thresholds for Cisco Managing which insights can seen by users Configuring and managing subscriptions Making changes to your deployment Appendix A:Configuring Impersonation Appendix B:Configuring the Skype for Business or Lync Server Appendix C:Configuring IIS Log Files to capture ActiveSync or OWA events Appendix D:PowerShell cmdlets used by data sources Appendix E:Custom configurations and backup and recovery options Appendix F: Questions and answers about configuration

Permissions needed for the Exchange Tracking Logs data source

For Exchange tracking logs, the specified credentials are used to collect message traffic and DLP incident data from the Exchange message tracking logs. (DLP data is collected only for Exchange 2013 and later.) The credentials must:

•
Have access rights to the share that contains the Exchange message tracking logs
•
Be a member of the View-Only Organization Management security group
•
Be a member of the Public Folder Management security group

You can gather Exchange message tracking logs from any of the following locations:

•
Directly from tracking log folders on each Exchange server
•
From user-created file shares on each Exchange server, such as \\ServerName\MessageTracking
•
From any file share that contains up-to-date Exchange tracking log copies. Original log files and compressed zip files (using either WinZip or Windows native compressed format) are supported.

For information about gathering historical tracking logs from a centralized location, see About collecting historical tracking logs .

Default locations for message tracking logs

By default, the Exchange message tracking log folder is located as follows:

•
Exchange 2010
\\ServerName\c$\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs\MessageTracking
•
Exchange 2013/2016/2019
\\ServerName\c$\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\MessageTracking

Permissions needed for Exchange Mailbox Contents, Exchange Mailbox Content Summary, or Exchange Calendar data sources

Credentials that are used to collect Exchange mailbox contents, Exchange mailbox content summary, or Exchange calendar data using Exchange Web Services (EWS) must have “Exchange Impersonation” permissions to all the target mailboxes:

•
For information about how to set Exchange impersonation for Exchange 2013/2016/2019, see Setting impersonation for Exchange 2013/2016/2019 .
•
For information about how to set Exchange impersonation for Exchange 2010, see the Microsoft article: Configuring Exchange Impersonation.
•
For information about how to set impersonation for Exchange Online (Office 365), see Setting impersonation for Office 365 .

The credential used to connect to a domain controller through LDAP must have access to user and group configuration information.

Permissions needed for the Exchange IIS Logs (ActiveSync and OWA) data source

When you configure an Exchange IIS logs data source, you specify two sets of credentials:

•
credentials for the LDAP connection to Active Directory
•
credentials for collecting the IIS log files from the Exchange CAS (Client Access Services)
Credentials to collect data through LDAP

The credentials that are used to collect device and user information through LDAP from Active Directory must have the following Active Directory permissions:

•
Must have read permissions for Active Directory user, domain, and Exchange server objects.
•
Must have read permission on the msExchMailboxGuid property of all user objects.

Usually, these read permissions are available to members of the Authenticated Users group. Consequently, you only need to be an authenticated user of the domain or of another domain that is trusted by the domain.

Credentials to collect the IIS log files

The credentials that are used to collect information from the IIS log files on the Exchange Client Access Server (CAS) must have the following permissions:

•
Local Administrators rights on all Exchange CAS servers

The Local Administrators rights are required to access to the IIS logs through an administrative volume share, such as C$.

As an alternative to providing Local Administrators rights, you could create a non-administrative share for the IIS log folder. You could then grant read access to the credentials to the IIS log files through the share.

Also, IIS logging must be configured on the Exchange CAS servers. For more information, see Appendix C: Configuring IIS Log Files to capture ActiveSync or OWA events .

Permissions needed for the Exchange Public Folders data source

When you configure an Exchange public folders data source, you can select whether you want to collect on-premises data from legacy public folders (Exchange 2010) or new (Exchange 2013, Exchange 2016, Exchange 2019) public folders.

For all the Exchange versions, the credentials that you specify to collect public folder data using remote PowerShell must:

•
Be a member of the Exchange View-Only Administrator role.
•
Have remote PowerShell access enabled.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating