5.8 Configuring Microsoft Exchange Monitoring

Change Guardian monitors the following in Microsoft Exchange:

  • Exchange Settings

  • Mailbox Accounts

  • Mailbox Messages

  • Management Role Groups

This section provides the following information:

The following diagram illustrates how Change Guardian collects events from Exchange server:

Figure 5-3 Microsoft Exchange Monitoring using Change Guardian

The deployment diagram illustrates the following:

  • Change Guardian Event Collector Addon for Windows Agent acts as the interface between Microsoft Exchange and Change Guardian. Change Guardian Event Collector Addon for Windows Agent pulls change event data from Exchange and stores the event details in a CEF log file.

  • Change Guardian Agent for Windows reads from the CEF log file and sends the event details to the Change Guardian server.

5.8.1 Implementation Checklist

Complete the following the tasks to start monitoring Microsoft Exchange events:

Task

See

Complete the prerequisites

Prerequisites

Add the license key

Adding a License Key

Configure Change Guardian for monitoring

Enabling Exchange Monitoring

Categories of Microsoft Exchange Policies

Triage events

Section 7.0, Managing Events

Section 8.0, Configuring Alerts

5.8.2 Prerequisites

Complete the following tasks in the same order:

IMPORTANT:Install Change Guardian Event Collector Addon for Windows Agent and Change Guardian Agent for Windows on the same machine as Microsoft Exchange server.

  1. Setting Up Exchange

  2. Install Change Guardian Event Collector Addon for Windows Agent

  3. Install Change Guardian Agent for Windows

  4. Install Policy Editor

5.8.3 Configuring Change Guardian for Monitoring

You must configure the Change Guardian server to receive Exchange event logs from Change Guardian Event Collector Addon for Windows Agent.

Enabling Exchange Monitoring

Ensure that you have added Exchange assets in Agent Manager.

To enable monitoring:

  1. In Agent Manager, select the asset and click Manage Installations > Install Agents.

    Or

    In Agent Manager, select the asset and click Manage Installations > Reconfigure Agents.

  2. In the Reconfigure Agent page, select Enable Collector Plugin under Edit Agent Configuration.

  3. Specify the location to store CEF events in CEF Data Output Path.

    NOTE:Ensure that the value in CEF Data Output Path matches the CEF data path you specify during Change Guardian Event Collector Addon for Windows Agent installation. You can get the CEF data path from the ceffolder parameter in <install_directory>\current\user\agent\agent.properties.

5.8.4 Categories of Microsoft Exchange Policies

Exchange Settings: Policies about creating and deleting configuration settings

Mailbox Accounts: Policies about creating, deleting and moving of mailbox accounts, and enabling and disabling mailbox accounts

Mailbox Messages: Policies about sending, moving, deleting messages, and so on

Management Role Groups: Policies about adding, deleting, and modifying role group, adding and removing group member, and so on

For information about creating policies, see Creating Change Guardian Policies.

After creating policies, you can assign them to assets. For information about assigning policies, see Working with Policies.

NOTE:While creating mailbox policies, you do not have to configure LDAP settings to browse the Exchange server mailboxes.