Comments on: Mailbox Access Auditing with Exchange 2007 SP2

By: Ben

Ben — Sat, 24 Apr 2010 06:01:55 +0000

You are indeed GURU OF EXCHANGE. Do you want to work for me. Snd email and will discuss.

By: Cristian

Cristian — Mon, 19 Apr 2010 16:38:42 +0000

I had to restart the Microsoft Exchange Information Store service before I could see the events logged in Exchange auditing

By: Kevin

Kevin — Thu, 01 Apr 2010 19:59:38 +0000

I’ve gone thru Micrsoft’s WHitepaper on setting this up 3 times, everything looks ok. 566 events are going into the Application Log not Security Log. I am getting no 10xxx events at all in the Exchange Auditing log.

By: pravish

pravish — Tue, 22 Dec 2009 11:05:08 +0000

Hi guys

Have spent hours trying to get this working, have followed the simple instructions above to enable auditing on MSExchangeIS but nothing is appearing under event viewer -> applications & services log -> exchange auditing.

I’ve got event ID 1016s so really need to get to the bottom of this, on paper the auditing from SP2 should be perfect for me but I just can’t get it working…

By: pravish

pravish — Mon, 21 Dec 2009 18:31:24 +0000

How does the exchange auditing logs work for outlook anywhere / RPC over HTTPs?

When enabling extended auditing will this work if someone is using cached mode remotely?

I’ve followed your steps above to enable high logging on 9000 -> private -> message access but am getting nothing under exchange auditing within event viewer. Any suggestions?

By: Larry

Larry — Thu, 15 Oct 2009 08:50:34 +0000

Ritesh,

The information you provided regarding tracking logons using IIS logs was really an eye opener.
Thanks for that.