Exchange 2007 logging

I want to log if someone is granting himself access to someone's Exchange 2007 mailbox.

If he loads the Exchange Management Console, expands Recipient Configuration, selects Mailbox.  He right clicks on a user, selects Manage Full User Permission and adds himself.

How do I log this?
LVL 1
magnusthorneAsked:
Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

x
 
GusGallowsConnect With a Mentor Commented:
I don't think Domain Administrator has sufficient rights on Exchange. You need to make sure you have the appropriate exchange role enabled for your account before turning on that level of auditing.

I believe you could do it if your account had either Exchange Server Administrator (Has to be set for each server), or Exchange Organization Administrator.

Those roles are assigned in the Exchange Management Console under the Exchange Organization tab.

0
 
esmith69Commented:
Adding the permissions via the Exchange Management Console is definitely not the only way to grant those permissions.  It can be done via the PowerShell as well.

Here is a similar EE post about how to do this.
http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/Windows_2003_Active_Directory/Q_23391043.html


I guess there's not a lot of capabilities to easily do this that are built in to Exchange.  Seems like there's lots of 3rd-part software that might do it...
0
 
magnusthorneAuthor Commented:
http://www.msexchange.org/articles_tutorials/exchange-server-2007/compliance-policies-archiving/exchange-2007-mailbox-access-auditing-part1.html

I enabled some logging as mentioned in the above link.  However, when I click on Exchange Auditing in Event Viewer, it says "Unable to complete the operation on "Exchange Auditing".  Access is denied.".  I'm logged in as the domain administration.  Did I turn off auditing?
0
All Courses

From novice to tech pro — start learning today.