CyberPoke101
asked on
Exchange Folder and User Logon Auditing 2007
We have an Exchange Server we upgraded from 2003.
I want to track\audit users logons and folder access.
So I setup to the reg keys for 9074 Folder Access and 9015 Logons.
I set the value to low hex = 1
Cool I am getting events in the Application folder. I confirm the level of auditing is set to low,
but wow the number of events is huge. I am going to need a very large event file to keep from
events wrapping even for a day...
The problem is, all the "Success Audit" entries are flooding the Application log...
So my questions is this; can I set Exchange such that those events log to a separate log?
That way I am not rolling the application event log so frequently....
Any help greatly appreciated.
I want to track\audit users logons and folder access.
So I setup to the reg keys for 9074 Folder Access and 9015 Logons.
I set the value to low hex = 1
Cool I am getting events in the Application folder. I confirm the level of auditing is set to low,
but wow the number of events is huge. I am going to need a very large event file to keep from
events wrapping even for a day...
The problem is, all the "Success Audit" entries are flooding the Application log...
So my questions is this; can I set Exchange such that those events log to a separate log?
That way I am not rolling the application event log so frequently....
Any help greatly appreciated.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
This question has been classified as abandoned and is closed as part of the Cleanup Program. See the recommendation for more details.