3.11 Set mailbox 'Turn on Administrator Audit Logging' to 'True'

Information

Administrator audit logging is used to provide a log of the settings that are changed by administrators anywhere in the system. By default this setting is turned on to ensure discovery of configuration related security breaches.

Rationale:

Administrators may be able to reconfigure the system to expose a vulnerability with no record of the changes made.

Solution

To implement the recommended state, execute the following PowerShell cmdlet:

Set-AdminAuditLogConfig -AdminAuditLogEnabled $true

See Also

https://workbench.cisecurity.org/files/1512

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-12

Plugin: Windows

Control ID: 398460157335671f3ef78ac2e0ef293ca7a506a5e867a1d05a3fe7f1553b7187