Ensure no accounts are configured to bypass mailbox audit logging

HochStufe 1Automatisiertexchange

Beschreibung

Accounts with AuditBypassEnabled can access mailboxes without generating audit records. Prints the number of bypass associations (expected 0). Run from an Exchange Management Shell or after `Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn`; the audit loads the snap-in itself when Get-ExchangeServer is missing and fails if it cannot.

So wird geprüft

Prüfmethode: Shell-Befehl

shell

$ErrorActionPreference = 'Stop'; if (-not (Get-Command Get-ExchangeServer -ErrorAction SilentlyContinue)) { Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn -ErrorAction Stop }; if (-not (Get-Command Get-ExchangeServer -ErrorAction SilentlyContinue)) { throw 'Exchange Management Shell cmdlets are not available' }; $bad = @(Get-MailboxAuditBypassAssociation -ResultSize Unlimited -ErrorAction Stop | Where-Object { $_.AuditBypassEnabled -eq $true }); $bad.Count

Erwartete Ausgabe: 0

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

For each reported identity, after confirming it is not a required service account: Set-MailboxAuditBypassAssociation -Identity <name> -AuditBypassEnabled $false

Eigenschaften

Betriebssysteme: Beliebig
Tags: exchangelogging
Referenz: CIS Microsoft Exchange Server Benchmark - Auditing / Mailbox audit bypass (verify section number for your release)

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target exchange