Source audit is enabled by default. Configuration is performed separately for each Microsoft Exchange server. Events from the following audit logs can be collected:

• Administrator audit. By default, administrator actions are logged when any cmdlets are run, except Get queries. The audit settings can be changed.
• Exchange Information Store services audit. For the server to log events, the Mailbox Server role is required. Setting up the source for collecting events from the log is not required.
• Transport system audit. For the server to log events, the Mailbox Server and Edge Transport roles are required.
• Mailbox logon audit. For the server to log events, the Mailbox Server role is required.
• Mailbox user activity audit. For the server to log events, the Mailbox Server role is required. The audit settings can be changed.

To collect events from a source in the Microsoft Exchange server domain, you must create a domain account and a server management role group including the following roles: Mailbox Search, Monitoring, View-Only Audit Logs, View-Only Configuration, and View-Only Recipients. Add the domain account you have created to this group.

Administrator audit logging

In order for MP 10 Collector to collect events related to administrator activity, you must do the following on the source:

1. Configure the administrator audit logging.
2. Use the OS tools to create a local OS user account for the MP 10 Collector access.
   You must enter the credentials of this account when adding a credential to MaxPatrol SIEM.
3. Add the account to the "Access this computer from the network" local (group) security policy.
4. Add the account to the Event Log Readers local user group.

Information Store service audit

For MP 10 Collector to collect Information Store events on the source, you must do the following:

1. Use the OS tools to create a local OS user account for the MP 10 Collector access.
   You must enter the credentials of this account when adding a credential to MaxPatrol SIEM.
2. Add the account to the "Access this computer from the network" local (group) security policy.
3. Add the account to the Event Log Readers local user group.

Transport system audit logging

By default, log files with transport system events are saved on the source host in the C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\MessageTracking folder.

In order for MP 10 Collector to collect transport system events on the source, you must do the following:

1. Configure the transport system audit logging.
2. Use the OS tools to create a domain OS user account for MP 10 Collector access.
   You must enter the credentials of this account when adding a credential to MaxPatrol SIEM.
3. Add the account to the "Access this computer from the network" local (group) security policy.
4. Configure shared access to the folder with the log files and grant the account read access to this folder.

Mailbox logon audit

In order for MP 10 Collector to start remotely collecting mailbox logon events on the source, you must do the following:

1. Use the OS tools to create a domain OS user account for MP 10 Collector access.
   You must enter the credentials of this account when adding a credential to MaxPatrol SIEM.
2. Add the account to the "Access this computer from the network" local (group) security policy.
3. Set up permission for the account to remotely run scripts Get-Mailbox and Get-MailboxStatistics.
4. Configure remote MP 10 Collector connection to the source.

Mailbox user activity audit

In order for MP 10 Collector to start remotely collecting mailbox user activity events on the source, you must do the following:

1. Configure the mailbox user activity audit.
2. Use the OS tools to create a domain OS user account for MP 10 Collector access.
   You must enter the credentials of this account when adding a credential to MaxPatrol SIEM.
3. Add the account to the "Access this computer from the network" local (group) security policy.
4. Set up permission for the account to remotely run the script Get-Mailbox.
5. Configure remote MP 10 Collector connection to the source.