Ensure mailbox auditing is not disabled at the organization level

高レベル 1自動exchange

説明

When AuditDisabled is $true, mailbox audit logging is switched off for every mailbox, removing evidence of mailbox access by owners, delegates and administrators. Run from an Exchange Management Shell or after `Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn`; the audit loads the snap-in itself when Get-ExchangeServer is missing and fails if it cannot.

チェック方法

監査方法: シェルコマンド

shell

$ErrorActionPreference = 'Stop'; if (-not (Get-Command Get-ExchangeServer -ErrorAction SilentlyContinue)) { Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn -ErrorAction Stop }; if (-not (Get-Command Get-ExchangeServer -ErrorAction SilentlyContinue)) { throw 'Exchange Management Shell cmdlets are not available' }; $o = Get-OrganizationConfig -ErrorAction Stop; if ($o.AuditDisabled -eq $false) { 'compliant' } else { 'noncompliant' }

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

Set-OrganizationConfig -AuditDisabled $false (Exchange 2019 CU / Exchange 2016 CU with organization-level audit setting).

プロパティ

オペレーティングシステム: すべて
タグ: exchangelogging
参照: CIS Microsoft Exchange Server Benchmark - Auditing / Mailbox audit logging (verify section number for your release)

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target exchange