Turn off auditing for exchange events

Posted on 2005-04-20
Last Modified: 2013-12-04
I have turned on "audit object access" in my server GPO and turned on auditing on a couple of sensative directories to enable me to view who is accessing these directories. This creates "object access" events in my security log which is what I want. However, in the security log there is whole lot of MS exchange "object access" events which I don't want to log. I opened Exchange System Manager and clicked on "properties" of Mailbox Store and Public Folder Store and turned of auditing under the security tab. The MS exchange "object access" events still being logged are:

Handle Closed:
 Object Server:          Microsoft Exchange
 Handle ID:                273679608
 Process ID:               2924
Question by:machealth

    Author Comment

    Also this eventid 565 is being logged:

    Object Open:
           Object Server:      Microsoft Exchange
           Object Type:      Microsoft Exchange Logon
           Object Name:      /o=MHSDELMAR/ou=first administrative group/cn=Recipients/cn=wdouglas
           New Handle ID:      -
           Operation ID:      {0,4046006}
           Process ID:      2924
           Primary User Name:      DPHMAINSERVER$
           Primary Domain:      MHSDELMAR
           Primary Logon ID:      (0x0,0x3E7)
           Client User Name:      wdouglas
           Client Domain:      MHSDELMAR
           Client Logon ID:      (0x0,0x3DBB55)
           Accesses            Unknown specific access (bit 8)
           Privileges            -

    Unknown specific access (bit 6)
    Unknown specific access (bit 7)
    Unknown specific access (bit 9)
    Unknown specific access (bit 10)
    Unknown specific access (bit 11)
    Unknown specific access (bit 12)
    Unknown specific access (bit 13)
    Unknown specific access (bit 14)
    Unknown specific access (bit 15)
                Send As
    LVL 1

    Accepted Solution


    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Highfive Gives IT Their Time Back

    Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

    This is a short article about OS X KeRanger, and what people can do to get rid of it.
    Container Orchestration platforms empower organizations to scale their apps at an exceptional rate. This is the reason numerous innovation-driven companies are moving apps to an appropriated datacenter wide platform that empowers them to scale at a …
    Migrating to Microsoft Office 365 is becoming increasingly popular for organizations both large and small. If you have made the leap to Microsoft’s cloud platform, you know that you will need to create a corporate email signature for your Office 365…
    Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…

    759 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    8 Experts available now in Live!

    Get 1:1 Help Now