Link to home
Start Free TrialLog in
Avatar of CyberPoke101
CyberPoke101

asked on

Exchange Folder and User Logon Auditing 2007

We have an Exchange Server we upgraded from 2003.
I want to track\audit users logons and folder access.

So I setup to the reg keys for 9074 Folder Access and 9015 Logons.

I set the value to low hex = 1

Cool I am getting events in the Application folder. I confirm the level of auditing is set to low,
but wow the number of events is huge. I am going to need a very large event file to keep from
events wrapping even for a day...

The problem is, all the "Success Audit" entries are flooding the Application log...

So my questions is this; can I set Exchange such that those events log to a separate log?
That way I am not rolling the application event log so frequently....

Any help greatly appreciated.
ASKER CERTIFIED SOLUTION
Avatar of Akhater
Akhater
Flag of Lebanon image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
This question has been classified as abandoned and is closed as part of the Cleanup Program. See the recommendation for more details.