← Back to Microsoft Exchange 2019 Mailbox Server Security Technical Implementation Guide

V-259654

CAT III (Low)

Exchange audit record parameters must be set.

Rule ID

SV-259654r960879_rule

STIG

Microsoft Exchange 2019 Mailbox Server Security Technical Implementation Guide

Version

V2R3

CCIs

CCI-000169

Discussion

Log files help establish a history of activities and can be useful in detecting attack attempts. This item declares the fields that must be available in the audit log file to adequately research events that are logged. Audit records should include the following fields to supply useful event accounting: Object modified, Cmdlet name, Cmdlet parameters, Modified parameters, Caller, Succeeded, and Originating server.

Check Content

Open the Exchange Management Shell and enter the following command:

Get-AdminAuditLogConfig | Select-Object -Property AdminAuditLogParameters

Note: The value of "*" indicates all parameters are being audited.

If the value of "AdminAuditLogParameters" is not set to "*", this is a finding.

Fix Text

Open the Exchange Management Shell and enter the following command:

Set-AdminAuditLogConfig -AdminAuditLogParameters *