Administrator Audit Logging In Exchange 2010…

Exchange 2010 brings a new feature to the table, to audit all actions performed by users & administrators in your messaging environment. All actions performed, irrespective of whether they are done in Console, Shell or ECP will be logged. The “Get” cmdlets won’t be logged, as it is unnecessary and will generate a large number…

Exchange 2010 brings a new feature to the table, to audit all actions performed by users & administrators in your messaging environment. All actions performed, irrespective of whether they are done in Console, Shell or ECP will be logged. The “Get” cmdlets won’t be logged, as it is unnecessary and will generate a large number of log files on a daily basis. This option gives your Manager (who may not be technical) the facility to trace back who performed what & when.

The following actions need to be completed before the feature becomes available. The cmdlet we use for most of these settings is Set-AdminAuditLogConfig.

  1. Configure a dedicated mailbox for storing all audit logs. Whenever an action is audited, full information is logged & sent as an email to this mailbox. Access to this mailbox has to be tightly controlled.
  2. The auditing feature needs to be enabled.
  3. Configure the audit agent to send logs to audit mailbox.
  4. The cmdlets to be audited needs to be configured, if you don’t want to audit everything.
  5. The parameters to be audited needs to be configured.

First step can be easily accomplished by creating a mailbox with a suitable name (say “Audit Mailbox”) and restrict access.

Admin auditing is disabled by default. Run Get-AdminAuditLogConfig | fl to confirm.

Admin Logging False

In order to enable auditing, run the following cmdlet.

Set-AdminAuditLogConfig –AdminAuditLogEnabled $true

Admin Logging True

Run the following cmdlet to configure the auditing agent to send logs to “Audit Mailbox”

Set-AdminAuditLogConfig –AdminAuditlogMailbox “AuditMailbox@Hew10.local

Set Mailbox For Logging

You can audit the cmdlets of your choice. For example, in order to audit any changes made to mailbox & transport features, we can use the wildcards *mailbox* and *transport*. Run the cmdlet below to audit just these cmdlets.

Set-AdminAuditLogConfig –AdminAuditLogCmdlets *mailbox*, *transport*

Set Cmdlets For Logging

In the same way, you can select the parameters of your choice. Run the cmdlet below to audit the parameters database and server,

Set-AdminAuditLogConfig –AdminAuditLogParameters database, server

Set Parameters For Logging

For demonstration of admin logging feature, I have created a new mailbox named “Audit Test”.

Audit Test Mailbox

Logging into the “Audit Mailbox” using OWA shows me a new email with detailed information on the task (creating the mailbox) that I had completed.

Email

The subject of the email specifies the user account used to run the cmdlet & the cmdlet that was executed.

Details1

The Run Date in the email shows the date & time when the cmdlet was run. The log also shows whether the cmdlet was executed successfully.

Details2

Next time you do something, beware! The auditing might be enabled!

Leave a Reply

Your email address will not be published. Required fields are marked *