|
|
|
date: Sat, 21 Jun 2008 13:23:09 +0330,
group: microsoft.public.exchange.admin
back
Re: Auditing Exchange Problem!
"Saeed Pazoki" ha scritto nel messaggio
news:OgTdaY40IHA.4040@TK2MSFTNGP04.phx.gbl...
> I want them to do what they want but I expect exchange server to log
> those things! If someone has disabled diagnostics logging I expect
> to see this in event viewer and know who has violated policies!
You can't, sorry.
It's the same thing as logging every other kind of administrative
activities: administrators, by definition, have administrative rights, so
they can disable logging and even delete logs. Or they can create other
administrative accounts and use *those* to purge logs, so nobody will even
be able to know who actually purged them and what was logged before. You
have to trust administrators, or remove them from this role.
Regarding Exchange, maybe you can grant them lower rights: instead of making
them Exchange full administrators, you can grant only them rights to manage
mailboxes. But if you want them to be able to manage your server's
configuration, then they will be able to turn on and off logging as they
wish.
Also, remember that what you're talking about is a *diagnostic* logging: it
was never intended to be a security auditing.
Massimo
date: Sat, 21 Jun 2008 12:20:45 +0200
author: Massimo
Re: Auditing Exchange Problem!
Thanks.
"Massimo" wrote in message
news:u$Q4xh40IHA.5832@TK2MSFTNGP02.phx.gbl...
> "Saeed Pazoki" ha scritto nel messaggio
> news:OgTdaY40IHA.4040@TK2MSFTNGP04.phx.gbl...
>
>> I want them to do what they want but I expect exchange server to log
>> those things! If someone has disabled diagnostics logging I expect
>> to see this in event viewer and know who has violated policies!
>
> You can't, sorry.
> It's the same thing as logging every other kind of administrative
> activities: administrators, by definition, have administrative rights, so
> they can disable logging and even delete logs. Or they can create other
> administrative accounts and use *those* to purge logs, so nobody will even
> be able to know who actually purged them and what was logged before. You
> have to trust administrators, or remove them from this role.
>
> Regarding Exchange, maybe you can grant them lower rights: instead of
> making them Exchange full administrators, you can grant only them rights
> to manage mailboxes. But if you want them to be able to manage your
> server's configuration, then they will be able to turn on and off logging
> as they wish.
>
> Also, remember that what you're talking about is a *diagnostic* logging:
> it was never intended to be a security auditing.
>
>
> Massimo
>
date: Sat, 21 Jun 2008 15:27:59 +0330
author: Saeed Pazoki
|
|
