Detections
Analytics

EX16-MB-000010 - Exchange must have Administrator audit logging enabled.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Unauthorized or malicious data changes can compromise the integrity and usefulness of the data. Automated attacks or malicious users with elevated privileges have the ability to effect change using the same mechanisms as email administrators.

Auditing any changes to access mechanisms not only supports accountability and nonrepudiation for those authorized to define the environment but also enables investigation of changes made by others who may not be authorized.

Note: This administrator auditing feature audits all exchange changes regardless of the user's assigned role or permissions.

Solution

Open the Exchange Management Shell and enter the following command:

Set-AdminAuditLogConfig -AdminAuditLogEnabled $true

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Exchange_2016_Y22M07_STIG.zip

Item Details

References: CAT|II, CCI|CCI-001403, Rule-ID|SV-228354r612748_rule, STIG-ID|EX16-MB-000010, STIG-Legacy|SV-95333, STIG-Legacy|V-80623, Vuln-ID|V-228354

Plugin: Windows

Control ID: 1766579ca00dcd897e3a3bf01fdc45c2181eb45b6fd8742fe4c0fa31bf5487f4