UCF STIG Viewer Logo

Exchange must have Audit record parameters set.


Overview

Finding ID Version Rule ID IA Controls Severity
V-69733 EX13-CA-000050 SV-84355r1_rule Low
Description
Log files help establish a history of activities, and can be useful in detecting attack attempts. This item declares the fields that must be available in the audit log file in order to adequately research events that are logged. Audit records should include the following fields to supply useful event accounting: Object modified, Cmdlet name, Cmdlet parameters, Modified parameters, Caller, Succeeded, and Originating server.
STIG Date
MS Exchange 2013 Client Access Server Security Technical Implementation Guide 2019-12-18

Details

Check Text ( C-70177r1_chk )
Open the Exchange Management Shell and enter the following command:

Get-AdminAuditLogConfig | Select Name, Identity, AdminAuditLogParameters

If the value of AdminAuditLogParameters is not set to {*}, this is a finding.

Note: The value of {*} indicates all parameters are being audited.
Fix Text (F-75939r1_fix)
Open the Exchange Management Shell and enter the following command:

Set-AdminAuditLogConfig -AdminAuditLogParameters *