One of the new features that service pack 2 of Exchange 2007 server brings is the ability to audit mailbox access. Now that the second service pack has been deployed in most production environments, I though it will be good to explain the steps to enable it, how to get the audited info & how to change the default settings. There are no new tabs or options which will catch your attention to enable mailbox access auditing within the EMC. Enabling this feature is bundled into “Managing Diagnostic Logging Properties” wizard. Check my previous article.
Access Auditing is controlled by diagnostic categories for Exchange Information Store (MSExchangeIS). We cannot use this feature to audit message deletions, only access is possible. Following are the four actions on which auditing is possible.
- Folder Access – Lets you log events that correspond to opening folders, such as the Inbox, Outbox, or Sent Items folders.
- Message Access – Lets you log events that correspond to explicitly opening messages.
- Extended Send As – Lets you log events that correspond to sending a message as a mailbox-enabled user.
- Extended Send On Behalf Of – Lets you log events that correspond to sending a message on behalf of a mailbox-enabled user.
How To Enable Mailbox Access Auditing?
Launch EMC & navigate to Server Configuration -> Mailbox. Select your mailbox server, right click & select “Manage Diagnostic Logging Properties”. Drill down to MSExchangeIS -> 9000 Private.
Expand the tree to see all the options & you will find the four options mentioned above.
Increase the logging level, depending upon the level of information you need & click Configure. That’s it!
How To Access The Audited Info?
Now that mailbox access auditing is enabled, we need to be able to get the information logged. SP2 creates a separate area for logging information related to mailbox access & it is named Exchange Auditing. Navigate to Event Viewer -> Applications & Services Log -> Exchange Auditing.
How To Change The Default Properties?
By default, the location for storing the the logs is in the exchange server installation directory, DriveProgram FilesMicrosoftExchange ServerLoggingAuditLogs to be precise. The default behaviour is to archive the logs when it gets full. Hence, the location of the logs should be changed to a drive that has enough free space. You can achieve this by selecting the properties of Exchange Audting & changing the options.
What About Service Accounts?
Any organization will have service accounts which have full access to the mailboxes, like accounts used to run backups. As this type of accounts will be used on a daily basis, we don’t need information about these accounts to fill up our mailbox access log. To overcome this issue, SP2 extends the schema with a new right named “Bypass Auditing”. Run the following command to exclude service accounts from being audited.
Get-MailboxDatabase –identity “serversgdbname” | Add-ADPermission –User “service account” –ExtendedRights ms-Exch-Store-Bypass-Access-Auditing –InheritanceType All
Anonymous January 17, 2010 at 12:14 am
Excellent Article. Quick quesiton: is there any way to get the Low Level logon event to go to this new log vs the Application log?
Thanks,
Dennis
Anonymous April 6, 2010 at 8:18 am
Nice article.
However, the threat is on the higher side when a privileged user uses a service account to login. So it is highly recommented to enable auditing for service accounts too.
Thanks/Peter
Anonymous April 8, 2010 at 4:24 pm
Hi,
After applying your procedure, I still have Exchange Auditing Event log empty, is this normal ?
Thanks
Anonymous April 21, 2010 at 8:28 pm
Does this mean that a local administrator on the server can be logged too? I have an Exchange Server 2007 "Illinois" which is part of AD. I can logon to the server using Local Admin account. I should be able to log that a Local Admin was accessing the mailbox of another user.
Shahin May 8, 2010 at 7:10 pm
What about the same for Exchange 2010. All these are missing fom the MSExchangeIS of Exchange 2010.
Johnston, Kevin February 2, 2011 at 1:24 pm
You must restart the Information Store service every time you change auditing log levels or your logs may be empty.
Rajith Jose Enchiparambil February 2, 2011 at 1:33 pm
Thanks Kevin
Anonymous May 17, 2011 at 2:48 pm
i have restarted the exchange server several times but it didn't want to log the events. and suddenly it logged all. when i open the calendar, contact folder or inbox folder… i don't know why. may be i have all the machines on VMs and they don't have enough memory…
Rajith Jose Enchiparambil May 17, 2011 at 4:44 pm
You have enabled logging and it didn't log for a while? Is that the issue?
Dave Harbourne May 23, 2012 at 8:09 am
Good post! just wondering does anyone know if this or any other exchange monitoring tool can monitor calendar deletions. I need to track who and when and from what device a calendar item got removed.
thanks