Exchange Server Auditing and Alerting

Your Exchange organization undergoes numerous changes every day, and as an administrator, you need to be constantly vigilant about changes happening to your critical components. Using Exchange's Event Viewer to sift through event logs for mailboxes, databases, and mailbox permissions is no simple task. For instance, if a user logs in to another user's mailbox—either accidentally or intentionally—or another isolated event occurs, crawling through event logs to investigate the breach is not the way to go.

If you want a better way to do this—and more—then Exchange Reporter Plus is the tool for you! Audit Exchange Server changes in real time and generate granular reports that help you audit changes to critical Exchange components instantly.

Report on and audit Exchange Online using Exchange Reporter Plus.

The most important feature of this auditing tool is its alerting capability, which notifies you as soon as changes occur in your Exchange environment. Select a component (mailbox, database, mailbox permissions, etc.) and severity level (critical, trouble, and attention) while configuring an alert so you can easily delegate and prioritize your alerts. As shown in Figure 1., each alert is color-coded based on its severity level.

Figure 1: Color-coded alerts.

Configure alerts for:

• Logins to mailboxes by both owners and non-owners.
• Changes to mailbox permissions.
• Changes to mailbox properties, such as storage quota, message size limits, and more.
• Changes to databases' circular logging setting.
• Unexpected mounting or dismounting of databases.
• Changes to server configurations such as hub transport settings, send and receive connectors, and more.
• Mailbox audit logging.
• Emails that were deleted or moved to another folder.

Customize existing alert profiles

Exchange Reporter Plus has three preconfigured alert profiles, which provide alerts for:

• Non-owner mailbox access.
• Changes to mailbox permissions.
• Mounting or dismounting of databases.

You can edit any aspect of Exchange Reporter Plus' predefined alert profiles, including their names, descriptions, severity levels, alert messages, and whether or not you want an email notification for them.

Create alert profiles

Create new alert profiles to get instant alerts on specific Exchange Server changes.

• Name your alerts and add a description, severity level, and notification message.
• Enable email notifications to receive alerts via email.
• Configure multiple email addresses to send alerts to several people.
• Receive alerts when several events occur over a short period of time using the Advanced Settings option.

Once you've created the corresponding alert profiles, the next time a user logs in to another user's mailbox, or gains Full Access permissions over an important mailbox in your organization, Exchange Reporter Plus will immediately draw your attention to it by sending you a notification.

Exchange Reporter Plus makes sure you receive real-time alerts on all changes to the critical components in your organization. Exchange Server change auditing and alerting keeps your confidential data secure, making sure that nothing slips through the cracks.

Exchange Reporter Plus is a web-based analysis, monitoring, and change auditing solution for your Exchange servers, including versions 2003, 2007, 2010, 2013, and 2016. It features over 200 unique reports on various Exchange entities such as mailboxes, public folders, Outlook Web Access, and ActiveSync. This all-around reporting solution also has customizable reports that locate messages based on their content, track room mailbox usage, as well as break down email response times. Configure alerts in Exchange Reporter Plus for instant notifications on critical changes that require your attention. Download a free trial today to explore all these features.