How to track when full access rights were issued in Exchange 2007?

Posted by ashln on Server Fault See other posts from Server Fault or by ashln
Published on 2010-06-11T01:42:07Z Indexed on 2010/06/11 1:53 UTC
Read the original article Hit count: 239

Filed under:

exchange-2007

|

security-audit

Hi

Does anyone know if there is a way to see when a user had been issued full mailbox rights in Exchange 2007. Or is there a way to check which commands were issued when and by whom?

Thanks

ashln

© Server Fault or respective owner

Related posts about exchange-2007

when using exchange 2010 it complains of not talking to Information Store service on exchange 2007

as seen on Server Fault - Search for 'Server Fault'
I am attempting to do an upgrade in my org from exchange 2007 to exchange 2010. I moved all the mailboxes and made sure my certificates were setup in exchange 2010. I then changed my ip forwarding rules to forward mail to my exchange 2010 box. I can receive email. I then powered off my exchange 2007… >>> More
Disk I/O error copying a Exchange 2007 database

as seen on Server Fault - Search for 'Server Fault'
Hi all, A short time ago due to disk space I moved our Exchange database onto an external drive, the drive was new and the database was being backed up daily. I've now discovered the database is corrupt, I've run the Exchange utils to fix the database and this works but it corrupts again as soon… >>> More
Do I have to prepare Active Directory prior to installing an Exchange service pack?

as seen on Server Fault - Search for 'Server Fault'
I'm having trouble determining the proper procedure for installing Exchange 2007 sp3 on a Server 2008 R2 box running Exchange 2007 sp1. It is not clear on websites I have consulted (Microsoft TechNet and others) whether preparing Active Directory is only required on a NEW install of Exchange 2007… >>> More
Exchange 2007 Owa (OnlineVersion) can not authenticate

as seen on Server Fault - Search for 'Server Fault'
Exchange Authentication dll: https://red002.mail.emea.microsoftonline.com/owa/auth/owaauth.dll sending style is: request.Method = "POST"; request.ContentType = "application/x-www-form-urlencoded"; And sending following message destination=https://red002.mail.emea.microsoftonline.com/owa/testuser@xxxserver… >>> More
Issues with doing a P2V on Exchange 2007

as seen on Server Fault - Search for 'Server Fault'
I shutdown all Exchange services on the physical box and did a convert. Everything converted fine. Server booted up no issues and I could receive email from the outside world with no issues. But I am unable to send emails internally or externally. They just sit in the Outbox. I also disabled the… >>> More

Related posts about security-audit

Step-by-Step: The Do-It-Yourself Security Audit

as seen on Internet.com - Search for 'Internet.com'
Step-by-Step: The Do-It-Yourself Security Audit >>> More
pslist causes security audit log failure on non-administrative user account

as seen on Server Fault - Search for 'Server Fault'
The user has RX privs. This event consistently arises in the security logs. How can this be resolved? Or what is the underlying issue here? Some additional information the user has local login disabled and log on as a service enabled. Failure Audit Category: Object Access Event ID 560 Object… >>> More
Excluding specific file types from a security audit in windows server 2008

as seen on Server Fault - Search for 'Server Fault'
Hi, I am looking for a way to exclude specific file types from being logged in the security audits. I have a folder being audited for deletion events and the majority of logged events are .tmp files (such as a temp Word file that is automatically deleted when the app is closed) which I do not care… >>> More
Security Audit Failures in Event Viewer Windows Server 2008R2

as seen on Server Fault - Search for 'Server Fault'
When I am looking at the security tab of my event viewer on a Windows Server 2008 R2, I am showing a ton of Audit Failures with Event ID 4776. The computer attempted to validate the credentials for an account. Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Logon Account: randy Source… >>> More
problem of setting audit rules: Syscall name unknown: stime

as seen on Server Fault - Search for 'Server Fault'
I am setting audit rules in /etc/audit/audit.rules. As the requirement : The audit system should be configured to audit all administrative, privileged, and security actions. So I add one line into /etc/audit/auditd.rules: -a exit,always -S stime -S acct -S reboot -S swapon However, after I restart… >>> More