Change Auditor 7.5 - User Guide

Exchange Auditing wizard

Exchange Auditing wizard

The Exchange Auditing wizard is displayed when you select Add (or Add | Exclude) on the Exchange Mailbox Auditing page. This wizard allows you to locate and select directory objects (such as User, Group, Container, DomainDNS, OrganizationalUnit, or BuiltinDomain) to add to the Exchange Mailbox Auditing list. Depending on the commands used (Add vs. Add | Exclude) you will either be selecting directory objects whose Exchange mailboxes are to be included or excluded from the auditing process.

The following table provides a description of the fields and controls in the Exchange Mailbox Auditing wizard.

 

Table 2. Exchange Auditing wizard

Select an Exchange Mailbox(es) to Audit page: This page opens when you select Add. From here, you select the Exchange mailboxes to audit. NOTE: To audit members of a group, select a security group (not a distribution group, even though distribution groups are included in the list).
Scope	Select one of the following options to define the scope of coverage: • Enterprise • This Object When the This Object option is selected the Browse and Search pages are enabled allowing you to select a directory object (such as user, group, container, DomainDNS, OrganizationalUnit, or BuiltinDomain) whose mailbox is to be audited.
Browse page	Displays a hierarchical view of the containers in your environment allowing you to locate and select the directory objects whose Exchange mailbox you want to audit. If required, use the Forest drop-down box to select in which forest the objects reside. Foreign agent forests may require foreign forests credentials which can be entered on the Credentials Required dialog. After you have selected an object, click Add to move the entry to the list at the bottom of the page.
Search page	Use the controls at the top of the Search page to search your environment to locate the directory objects whose Exchange mailbox you want to audit. After you have selected an object, click Add to move the entry to the list at the bottom of the page.
Options page	Use this page to modify the search options used to retrieve directory objects.
Selection List	The directory objects selected for mailbox auditing are displayed in the list box located across the bottom of this page. Use the buttons located above this list box to add and remove objects. • Add - Select an object in the Browse or Search page and then click Add. • Remove - Select an entry in the selection list and then click Remove.
Select An Exchange Mailbox(es) to Exclude From Auditing page: This page opens when you select Add | Exclude. From here, you can select the directory objects whose mailboxes are to be excluded from auditing. NOTE: To exclude members of a group, you must select a security group (not a distribution group, even though distribution groups are included in the list).
Scope	Select one of the following options to define the scope of coverage: • Enterprise • This Object When the This Object option is selected the Browse and Search pages are enabled allowing you to select a directory object (for example, user, group, container, DomainDNS, OrganizationalUnit, or BuiltinDomain) whose mailbox is to be excluded from being audited.
Browse page	Displays a hierarchical view of the containers in your environment allowing you to locate and select the directory objects whose Exchange mailbox is to be excluded from being audited. If required, use the Forest drop-down box to select in which forest the objects reside. Foreign agent forests may require foreign forests credentials which can be entered on the Credentials Required dialog. Once you have selected an object, click Add to move the entry to the list at the bottom of the page.
Search page	Use the controls at the top of the Search page to search your environment to locate the directory objects whose Exchange mailbox is to be excluded from being audited. Once you have selected an object, click Add to move the entry to the list at the bottom of the page.
Options page	Use this page to modify the search options used to retrieve directory objects.
Excluded Objects List	The directory objects selected for exclusion from Exchange mailbox auditing are displayed in the list box across the bottom of this page. Use the buttons located above this list box to add and remove objects. • Add - Select an object in the Browse or Search page and then click Add. • Remove - Select an entry in the Excluded Objects list and then click Remove.

Exchange Settings and Event Logging (Agent Configuration Page)

Exchange Settings and Event Logging (Agent Configuration Page)

•	Introduction

•	Exchange Folder Open Event setting

•	Exchange event logging

Introduction

Introduction

From the Agent Configuration page on the Administration Tasks tab you can define how Change Auditor handles duplicate Exchange folder open events and enable and disable event logging for Exchange events.

NOTE: This setting and event logging apply to the Exchange subsystem and therefore do not apply to Microsoft 365 Exchange Online events, which are part of the Microsoft 365 subsystem.

Exchange Folder Open Event setting

Exchange Folder Open Event setting

Use the Exchange tab at the top of the Configuration Setup dialog to define how Change Auditor handles duplicate folder open events.

Discard duplicates that occur within nn seconds

This setting defines how long to hold Exchange folder open events to determine if duplicates have occurred before they are forwarded to the client. This process is intended to eliminate the folder open events that Outlook or OWA Exchange users get when their inbox is automatically refreshed.

By default, this setting is set to zero indicating that it is turned off and duplicate folder opens are sent. However, you can use the arrow controls to enable this setting and specify the amount of time to hold folder open events to determine if duplicates have occurred. Valid range is 0 - 600 seconds.

To set the duplicate folder open event setting:

1	Open the Administration Tasks tab.

2	Click Configuration.

3	Select Agent in the Configuration task list to display the Agent Configuration page.

4	Click Configurations.

5	On the Configuration Setup dialog, select an agent configuration from the left-hand pane.

6	Open the Exchange tab and set the duplicate folder open event setting as defined above.

7	Once you have set this setting, click OK to save your selections, close the dialog and return to the Agent Configuration page.

8	On the Agent Configuration page, select the agents assigned to the selected configuration and click Refresh Configuration to ensure the agents are using the latest configuration. Exchange event logging

NOTE: If you do not refresh the agent’s configuration, the agent automatically checks for a new agent configuration based on the polling interval setting (located on the System Settings tab of the Configuration Setup dialog). The default is every 15 minutes.