Ensure mailbox auditing is not disabled at the organization level

YüksekDüzey 1Otomatikexchange

Açıklama

When AuditDisabled is $true, mailbox audit logging is switched off for every mailbox, removing evidence of mailbox access by owners, delegates and administrators. Run from an Exchange Management Shell or after `Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn`; the audit loads the snap-in itself when Get-ExchangeServer is missing and fails if it cannot.

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

shell

$ErrorActionPreference = 'Stop'; if (-not (Get-Command Get-ExchangeServer -ErrorAction SilentlyContinue)) { Add-PSSnapin Microsoft.Exchange.Management.PowerShell.SnapIn -ErrorAction Stop }; if (-not (Get-Command Get-ExchangeServer -ErrorAction SilentlyContinue)) { throw 'Exchange Management Shell cmdlets are not available' }; $o = Get-OrganizationConfig -ErrorAction Stop; if ($o.AuditDisabled -eq $false) { 'compliant' } else { 'noncompliant' }

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Set-OrganizationConfig -AuditDisabled $false (Exchange 2019 CU / Exchange 2016 CU with organization-level audit setting).

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: exchangelogging
Referans: CIS Microsoft Exchange Server Benchmark - Auditing / Mailbox audit logging (verify section number for your release)

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target exchange