Skip to content

Exchange Audit record parameters must be set.

An XCCDF Rule

Description

Log files help establish a history of activities and can be useful in detecting attack attempts. This item declares the fields that must be available in the audit log file in order to adequately research events that are logged. Audit records should include the following fields to supply useful event accounting: Object modified, Cmdlet name, Cmdlet parameters, Modified parameters, Caller, Succeeded, and Originating server.

ID
SV-228359r879559_rule
Version
EX16-MB-000060
Severity
Low
References
Updated

Remediation Templates

A Manual Procedure

Open the Exchange Management Shell and enter the following command:

Set-AdminAuditLogConfig -AdminAuditLogParameters *