Exchange Admin Audit log


Exchange Admin Audit log

d

On my exchange server, in the MSExchange Management log, I see an eventID 1 with a MSExchange CmdletLogs source,for: Cmdlet Add-MailboxPermission.  This event is for the when an administrator is granting Full access to a user's mailbox.

I do not see these logs being syslog to our SIEM.  There are other logs being sent over, but not from the Admin Audit Log.  

What in my configuration am I missing that these logs are not being syslogged? Thank you.
Tamas Lengyel

dadam - 10/11/2019
On my exchange server, in the MSExchange Management log, I see an eventID 1 with a MSExchange CmdletLogs source,for: Cmdlet Add-MailboxPermission.  This event is for the when an administrator is granting Full access to a user's mailbox.

I do not see these logs being syslog to our SIEM.  There are other logs being sent over, but not from the Admin Audit Log.  

What in my configuration am I missing that these logs are not being syslogged? Thank you.

What do you mean "there are other logs being sent over"? Are mailbox audit log events forwarded? Are there any admin audit log events being forwarded?

What is the result of the following command run from an Exchange Management Shell:
Get-AdminAuditLogConfig | Format-List

GO


Similar Topics


Reading This Topic


Login
Existing Account
Email Address:


Password:


Select a Forum....








LOGbinder Forum


Search