none
Exchange permission auditing

    Question

  • I have a very important exchange mailbox (exchange 2013) and I have enabled “hide from address list” so other can’t see it. In future if someone changes and it goes visible to everyone. So, I would like know what should I do to track that made this change in my exchange environment.
    Monday, November 11, 2013 9:56 AM

Answers

  • Hi,

    Agree.

    Since Administrator audit logging is enabled by default, we can firstly use the command below to verify the it’s enabled:

    Get-AdminAuditLogConfig | FL AdminAuditLogEnabled

    Here are the steps to view the administrator audit log using EAC:

    1.In the EAC, navigate to Compliance management > Auditing, and choose View the administrator audit log.

    2.Choose a Start date and End date, and then choose Search. All configuration changes made during the specified time period are displayed, and can be sorted, using the following information:

    Date   The date and time that the configuration change was made. The date and time are stored in Coordinated Universal Time (UTC) format.

    Cmdlet   The name of the cmdlet that was used to make the configuration change.

    User   The name of the user account of the user who made the configuration change.

    Up to 1000 entries will be displayed on multiple pages. Specify a smaller date range if you need to narrow your results. If you select an individual search result, the following information is displayed in the details pane:

    Object modified   The object that was modified by the cmdlet.

    Parameters (Parameter:Value)   The cmdlet parameters that were used, and any value specified with the parameter.

    3.If you want to print a specific audit log entry, choose the Print button in the details pane.

    You can also choose to export the report using EAC.

    Regards,


    Rebecca Tu
    TechNet Community Support

    Tuesday, November 12, 2013 8:43 AM
  • Agreeing to the above said answer you can enable the manual auditing and moreover please see the link for more details.

    http://itknowledgeexchange.techtarget.com/itanswers/track-mailbox-access-on-exchange-2007/

    Moreover please click on the link for an third party application also for the same.

    Thanks.

    Tuesday, November 12, 2013 2:50 PM

All replies

  • You can use the administrator auditing logs feature to find who modified the property..

    for more information - http://technet.microsoft.com/en-us/library/dd335144(v=exchg.150).aspx

    Please inform if any other details required on the above feature

    Monday, November 11, 2013 1:36 PM
  • Hi,

    Agree.

    Since Administrator audit logging is enabled by default, we can firstly use the command below to verify the it’s enabled:

    Get-AdminAuditLogConfig | FL AdminAuditLogEnabled

    Here are the steps to view the administrator audit log using EAC:

    1.In the EAC, navigate to Compliance management > Auditing, and choose View the administrator audit log.

    2.Choose a Start date and End date, and then choose Search. All configuration changes made during the specified time period are displayed, and can be sorted, using the following information:

    Date   The date and time that the configuration change was made. The date and time are stored in Coordinated Universal Time (UTC) format.

    Cmdlet   The name of the cmdlet that was used to make the configuration change.

    User   The name of the user account of the user who made the configuration change.

    Up to 1000 entries will be displayed on multiple pages. Specify a smaller date range if you need to narrow your results. If you select an individual search result, the following information is displayed in the details pane:

    Object modified   The object that was modified by the cmdlet.

    Parameters (Parameter:Value)   The cmdlet parameters that were used, and any value specified with the parameter.

    3.If you want to print a specific audit log entry, choose the Print button in the details pane.

    You can also choose to export the report using EAC.

    Regards,


    Rebecca Tu
    TechNet Community Support

    Tuesday, November 12, 2013 8:43 AM
  • Agreeing to the above said answer you can enable the manual auditing and moreover please see the link for more details.

    http://itknowledgeexchange.techtarget.com/itanswers/track-mailbox-access-on-exchange-2007/

    Moreover please click on the link for an third party application also for the same.

    Thanks.

    Tuesday, November 12, 2013 2:50 PM
  • Thanks guys
    Wednesday, November 13, 2013 12:27 PM