Mailbox Access Auditing In Exchange 2007 SP2…

Share & Comment

One of the new features that service pack 2 of Exchange 2007 server brings is the ability to audit mailbox access. Now that the second service pack has been deployed in most production environments, I though it will be good to explain the steps to enable it, how to get the audited info & how to change the default settings. There are no new tabs or options which will catch your attention to enable mailbox access auditing within the EMC. Enabling this feature is bundled into “Managing Diagnostic Logging Properties” wizard. Check my previous article.

Access Auditing is controlled by diagnostic categories for Exchange Information Store (MSExchangeIS). We cannot use this feature to audit message deletions, only access is possible. Following are the four actions on which auditing is possible.

  • Folder Access – Lets you log events that correspond to opening folders, such as the Inbox, Outbox, or Sent Items folders.
  • Message Access – Lets you log events that correspond to explicitly opening messages.
  • Extended Send As – Lets you log events that correspond to sending a message as a mailbox-enabled user.
  • Extended Send On Behalf Of – Lets you log events that correspond to sending a message on behalf of a mailbox-enabled user.

How To Enable Mailbox Access Auditing?

Launch EMC & navigate to Server Configuration -> Mailbox. Select your mailbox server, right click & select “Manage Diagnostic Logging Properties”. Drill down to MSExchangeIS -> 9000 Private.

Auditing Enable

Expand the tree to see all the options & you will find the four options mentioned above.

Auditing Parameters

Increase the logging level, depending upon the level of information you need & click Configure. That’s it!

How To Access The Audited Info?

Now that mailbox access auditing is enabled, we need to be able to get the information logged. SP2 creates a separate area for logging information related to mailbox access & it is named Exchange Auditing. Navigate to Event Viewer -> Applications & Services Log -> Exchange Auditing.

Auditing

How To Change The Default Properties?

By default, the location for storing the the logs is in the exchange server installation directory, DriveProgram FilesMicrosoftExchange ServerLoggingAuditLogs to be precise. The default behaviour is to archive the logs when it gets full. Hence, the location of the logs should be changed to a drive that has enough free space. You can achieve this by selecting the properties of Exchange Audting & changing the options.

Auditing Properties

What About Service Accounts?

Any organization will have service accounts which have full access to the mailboxes, like accounts used to run backups. As this type of accounts will be used on a daily basis, we don’t need information about these accounts to fill up our mailbox access log. To overcome this issue, SP2 extends the schema with a new right named “Bypass Auditing”. Run the following command to exclude service accounts from being audited.

Get-MailboxDatabase –identity “serversgdbname” | Add-ADPermission –User “service account” –ExtendedRights ms-Exch-Store-Bypass-Access-Auditing –InheritanceType All

Share & Comment
Subscribe for Updates
Never miss a blog post again

10 comments… add one

  1. Anonymous

    Excellent Article. Quick quesiton: is there any way to get the Low Level logon event to go to this new log vs the Application log?

    Thanks,
    Dennis

  2. Anonymous

    Nice article.

    However, the threat is on the higher side when a privileged user uses a service account to login. So it is highly recommented to enable auditing for service accounts too.

    Thanks/Peter

  3. Anonymous

    Hi,

    After applying your procedure, I still have Exchange Auditing Event log empty, is this normal ?

    Thanks

  4. Anonymous

    Does this mean that a local administrator on the server can be logged too? I have an Exchange Server 2007 "Illinois" which is part of AD. I can logon to the server using Local Admin account. I should be able to log that a Local Admin was accessing the mailbox of another user.

  5. Shahin

    What about the same for Exchange 2010. All these are missing fom the MSExchangeIS of Exchange 2010.

  6. Johnston, Kevin

    You must restart the Information Store service every time you change auditing log levels or your logs may be empty.

  7. Thanks Kevin

  8. Anonymous

    i have restarted the exchange server several times but it didn't want to log the events. and suddenly it logged all. when i open the calendar, contact folder or inbox folder… i don't know why. may be i have all the machines on VMs and they don't have enough memory…

  9. You have enabled logging and it didn't log for a while? Is that the issue?

  10. Dave Harbourne

    Good post! just wondering does anyone know if this or any other exchange monitoring tool can monitor calendar deletions. I need to track who and when and from what device a calendar item got removed.
    thanks

Leave a Comment