Exchange Server Auditing with Netwrix Auditor

Available Reports

All Changes Reports Description
Generic:
All MS Exchange Changes Shows all changes made to Exchange permissions and configuration, filtered by date range and user name who made changes. Download report sample.
All MS Exchange Changes by Date Shows all changes made to Exchange permissions and configuration grouped by date. Filtered by date range and user name who made changes.
All MS Exchange Changes by Date (Chart) Graphical representation of all changes made to Exchange permissions and configuration grouped by date. Filtered by preferred date range.
All MS Exchange Changes by Object Type Shows all changes made to Exchange objects grouped by object type (Store, Server, Address List, etc). Filtered by date range and user name who made changes.
All MS Exchange Changes by User Shows all changes made to Exchange objects grouped by user who made changes. Filtered by date range and user name who made changes.
All MS Exchange Changes by User (Chart) Graphical representation of all changes to Exchange objects grouped by user who made changes. You can filter by preferred date range.
Address List Changes:
Address List Changes Exchange address lists control access to corporate directory of employees. Accidental or unauthorized changes to address list configuration can limit people`s ability to send e-mails and therefore should be carefully monitored.
Address Lists Added Every organization usually has established set of address lists and addition of a new address list may indicate unauthorized activity.
Address Lists Removed Every organization usually has established set of address lists and removal of an address may break the ability to send e-mails and view employees' contact information.
Mailbox:
Mailbox Delegation Shows changes to mailbox delegation settings. Such changes shall only occur under specific circumstances, such as person going on vacation or employee termination. Who changed field in this report should usually point to a mailbox owner, otherwise it might indicate unauthorized access by person with excessive administrative rights.
Mailbox Quota Changes Shows all changes in mailbox quota settings. Changes to mailbox quotas shall be regularly reviewed by Exchange administrators to control storage usage.
Mailbox Security Changes Shows changes to mailbox permissions done by IT administrators and by end users themselves. Mailbox permissions must be reviewed regularly as they control access to sensitive information stored in user mailboxes.
Mailbox Settings and Permission Changes Shows changes to user mailboxes. All changes made to mailboxes must be regularly reviewed for accuracy.
Mailboxes Created Shows creation of new mailboxes that usually reflects hiring of new employees. Newly created mailboxes must be reviewed to detect unauthorized activity.
Mailboxes Removed Shows deleted mailboxes. This report should be reviewed to detect accidental destruction of mailboxes and ensure their fast recovery from backup storage.
Recipient:
Recipient Policies Added Shows newly created recipient policies. New policies should be reviewed for accuracy on a regular basis.
Recipient Policies Removed Shows deleted recipient policies. This report can be used to detect accidental and unauthorized deletions before they affect organization's e-mail system.
Recipient Policy Changes Shows all changes made to recipient policy settings and permissions. Changes to security policy must be monitored for security and compliance.
Recipient Update Service Changes Lists all recipient update service changes grouped by user (Exchange 2003 only).
Recipient Update Services Added Lists all added recipient update services grouped by user (Exchange 2003 only).
Recipient Update Services Removed Lists all removed recipient update services grouped by user (Exchange 2003 only).
Server:
All MS Exchange Changes by Server Shows all changes made to Exchange objects grouped by server where changes were made. Filtered by date range, domain name and where they occurred.
MS Exchange Servers Added Shows addition of new servers to Exchange organizations. Installation of new servers must be reviewed to make sure no rogue servers are installed.
Storage Group:
MS Exchange Storage Group Changes Storage groups contain all Exchange stores and modifications of storage group settings can affect the entire Exchange organization.
MS Exchange Storage Groups Added Storage group creation is usually a carefully planned operation and this report can be used to review the process.
MS Exchange Storage Groups Removed Storage groups are rarely removed and this report should be reviewed regularly to detect any unplanned actions.
Store:
MS Exchange Store Changes Exchange stores hold all exchange data, such as messages, contacts, tasks, etc. This report shows modification of store settings and permissions, without changes made to stored content.
MS Exchange Stores Added Shows all new created stores. Creation of new stores should be carefully planned and reviewed to avoid unnecessary creation of new stores.
MS Exchange Stores Removed Shows all deleted stores. Stores are rarely deleted and this report can be used to detect all accidental and unauthorized deletions before they impact the operations.