Exchange Folder and User Logon Auditing 2007
Posted on 2011-03-23
We have an Exchange Server we upgraded from 2003.
I want to track\audit users logons and folder access.
So I setup to the reg keys for 9074 Folder Access and 9015 Logons.
I set the value to low hex = 1
Cool I am getting events in the Application folder. I confirm the level of auditing is set to low,
but wow the number of events is huge. I am going to need a very large event file to keep from
events wrapping even for a day...
The problem is, all the "Success Audit" entries are flooding the Application log...
So my questions is this; can I set Exchange such that those events log to a separate log?
That way I am not rolling the application event log so frequently....
Any help greatly appreciated.