Re: MS Exchange admin auditing

Author	All Replies
techjoe Premium join:2004-02-20 Worth, IL ·Sprint Mobile Broa.. edit: May 2nd, @07:19PM	reply to midranger4 Re: MS Exchange admin auditing Read up on Object Access and other security auditing options. Also see »support.microsoft.com/default.as···s;867640 I deal with SOx and a series of internal audits at my shop and we've enabled a lot of object access/modification auditing to comply with audit requests and guidelines. It's not very difficult and when properly archived and presented they can provide a nice database of who's been doing what in case of any security events that may occur. With that said, who's collecting the logs and how? The same 'suspects' that may be accessing the mailboxes? Can you trust them to maintain accurate and intact logs when you can't trust them with the data they maintain? Want to see an auditor's head explode? Try getting a real answer that to that kind of question! There's many other ways to peek at a mailbox...restore a store to your test lab and mount it? Use one of the commercial EDB extraction tools to pull data from the raw files? Remote screen monitoring? I'll agree it's silly to RELY upon for audit reasons, but often you're best off just complying with the request and moving on..? I'll repeat one phase I particularly like from above...Who will watch the watchers? -- Baka wa shinanakya naoranai
	to forum · permalink · · 2008-05-02 19:17:43 ·


Monday, 06-Oct 08:28:00	Terms of Use \| Privacy Policy \| Hosting by www.nac.net - DSL,Hosting & Co-lo \| feedback \| contact over 9 years online! © 1999-2008 dslreports.com. page compression OFF