How to detect who gave full access permissions to an Exchange mailbox

Introduction Granting full access permissions to a mailbox in Exchange server should be well justified. Having received these permiss...

Introduction

Granting full access permissions to a mailbox in Exchange server should be well justified. Having received these permissions, users gain access to the mailbox content and can delete it or move to another location. Misuse of the full access permissions may lead to data losses and leaks.

http://start.netwrix.com/how_to_detect_full_access_permission_changes_to_exchange_mailbox.html

Steps (5 total)

1

Configure Admin Audit Log

Open the Exchange Management Shell, and run the following cmdlets:
Set-AdminAuditLogConfig – AdminAuditLogEnabled $true
Set-AdminAuditLogConfig – LogLevel Verbose (for Exchange 2013).

2

Event Log

Run eventvwr.msc → Applications and Services Logs → MSExchange Management → search for log with cmdlet “Add(Remove)-MailboxPermission” – where you can find information about who changed mailbox permissions, when it happened, to what mailbox and what kind of access to whom was given.

3

Exchange Admin Center

You can also find this information in Exchange Admin Center in your browser → Compliance Management → Auditing → click “View the administrator audit log”.

4

PowerShell

Also via power shell - Open the Exchange Management Shell and run the following cmdlet:
Search-AdminAuditLog –cmdlets Add(Remove)-MailboxPermission.

5

Real Life Use Case

http://www.youtube.com/watch?v=QhqHoBEjSCU

Conclusion

Works well for Microsoft Exchange 2010 and above.

References

• Netwrix Change Notifier Widget for Spiceworks
• Netwrix Auditor for Exchange Server
• How to Detect Who Gave Full Access Permissions to Exchange Mailbox