Jump to content


Photo

Exchange Change Reporter: Who Changed is "system"


  • Please log in to reply
5 replies to this topic

#1 comando

comando

    Newbie

  • Members
  • Pip
  • 7 posts

Posted 24 July 2009 - 05:01 PM

In Exchange Change Reporter: Who Changed is "system"


http://img512.images...973/reporto.jpg
http://img195.images...528/masexch.jpg
http://img199.images...9/3748/beei.jpg
http://img27.imagesh...2/dibujo22b.jpg


error.txt says
"Your configuration container audit settings may prevent the 'Who Changed' field from being reported correctly. Please refer to the Troubleshooting section of the product documentation for more information."


I added security policies on Exchange without success
http://img514.images...riaexchange.jpg

I must do others configurations on Exchange Server ?

==============

PD.

My AD Change Reports "Who and When" are OK

http://img16.imagesh...24/reportsk.jpg
http://img30.imagesh...161/reportx.jpg

I did this

1) Auditing of Directory Service Access | Success is not turned on in the Domain Controller policy.
http://img39.imagesh...9/9818/dib3.jpg
2) Auditing is not turned on your AD objects (the help file explains what must be turned on and how).
http://img136.images...6/1097/dib4.jpg
3) Security event logs are not big enough to hold all required audit events for at least 36 hours. (size?)
http://img196.images...0/dibujomat.jpg
http://img136.images.../dibujo2zhl.jpg

#2 Brian Stern

Brian Stern

    Advanced Member

  • Technical Support
  • PipPipPip
  • 259 posts

Posted 19 August 2009 - 02:04 PM

QUOTE (comando @ Jul 24 2009, 12:01 PM) <{POST_SNAPBACK}>
In Exchange Change Reporter: Who Changed is "system"


http://img512.images...973/reporto.jpg
http://img195.images...528/masexch.jpg
http://img199.images...9/3748/beei.jpg
http://img27.imagesh...2/dibujo22b.jpg


error.txt says
"Your configuration container audit settings may prevent the 'Who Changed' field from being reported correctly. Please refer to the Troubleshooting section of the product documentation for more information."


I added security policies on Exchange without success
http://img514.images...riaexchange.jpg

I must do others configurations on Exchange Server ?

==============

PD.

My AD Change Reports "Who and When" are OK

http://img16.imagesh...24/reportsk.jpg
http://img30.imagesh...161/reportx.jpg

I did this

1) Auditing of Directory Service Access | Success is not turned on in the Domain Controller policy.
http://img39.imagesh...9/9818/dib3.jpg
2) Auditing is not turned on your AD objects (the help file explains what must be turned on and how).
http://img136.images...6/1097/dib4.jpg
3) Security event logs are not big enough to hold all required audit events for at least 36 hours. (size?)
http://img196.images...0/dibujomat.jpg
http://img136.images.../dibujo2zhl.jpg


Dear comando,

Thank you for your Forum post. I am sorry for my delayed response.

What did you get in the report after all the configuration was completed. Can you send the exact text of the attached file if it is present in the report.

Sincerely,
Brian Stern


#3 comando

comando

    Newbie

  • Members
  • Pip
  • 7 posts

Posted 19 August 2009 - 03:44 PM

QUOTE (Brian Stern @ Aug 19 2009, 09:04 AM) <{POST_SNAPBACK}>
Dear comando,

Thank you for your Forum post. I am sorry for my delayed response.

What did you get in the report after all the configuration was completed. Can you send the exact text of the attached file if it is present in the report.

Sincerely,
Brian Stern



configuration:
http://img30.imagesh...47/adchange.jpg

Exchange Change Report:
http://img195.images...528/masexch.jpg


2009_8_7_23_46.adcr_errors.txt(346B) says:

" Your configuration container audit settings may prevent the 'Who Changed'
field from being reported correctly. Please refer to the Troubleshooting section of the product documentation for more information. "

=======

I hope to hear from you soon...
thanks

#4 Brian Stern

Brian Stern

    Advanced Member

  • Technical Support
  • PipPipPip
  • 259 posts

Posted 06 December 2010 - 04:06 PM

<!--quoteo(post=433:date=Aug 19 2009, 09:04 AM:name=Brian Stern)--><div class='quotetop'>QUOTE (Brian Stern @ Aug 19 2009, 09:04 AM) <a href="index.php?act=findpost&pid=433"><{POST_SNAPBACK}></a></div><div class='quotemain'><!--quotec-->Dear comando,

Thank you for your Forum post. I am sorry for my delayed response.

What did you get in the report after all the configuration was completed. Can you send the exact text of the attached file if it is present in the report.

Sincerely,
Brian Stern<!--QuoteEnd--></div><!--QuoteEEnd-->


configuration:
<a href="http://img30.imagesh...7/adchange.jpg" target="_blank">http://img30.imagesh...dchange.jpg</a>

Exchange Change Report:
<a href="http://img195.images...28/masexch.jpg" target="_blank">http://img195.images...masexch.jpg</a>


2009_8_7_23_46.adcr_errors.txt(346B) says:

" Your configuration container audit settings may prevent the 'Who Changed'
field from being reported correctly. Please refer to the Troubleshooting section of the product documentation for more information. "

=======

I hope to hear from you soon...
thanks



#5 Brian Stern

Brian Stern

    Advanced Member

  • Technical Support
  • PipPipPip
  • 259 posts

Posted 06 December 2010 - 04:12 PM

Dear Comado,

Thank you for your forum post.

In order to resolve this issue, please perform the following steps:

1. Configure Object-level AD auditing for ALL AD objects (not only domain controller objects or users making changes) to audit all modifications. Please configure the following in the ADUC snap-in if you are not sure:

a. Make sure that the ADUC Advanced mode is turned on: from the main menu select View, then Advanced Features
b. Right-click the root domain object, select the Security tab, click Advanced and select the Auditing tab
c. Click Add and type Everyone. Then click OK
d. Set the ‘Apply onto’ setting as ‘This object and all child objects (default)’. On Windows Server 2008, this setting is called ‘This object and all descendant objects’.
e. Select all Successful Audit items except for the following: Full Control, List Contents, Read Permissions, Read All Properties
IMPORTANT: Do NOT click the checkbox named ‘Apply these auditing to objects and/or containers within this container only’. Otherwise no auditing settings will be propagated to child objects of the domain object and you will get incorrect 'who changed' information for them.
f.Click OK


2. You need to enable object level auditing on the containers mentioned in the error report. Please perform the following steps on the problematic domain controller(s):
a. Click Start | Run | type “ADSIedit.msc” and click OK
Note: The ADSI Edit utility is part of Windows Support Tools. It can be downloaded with the following link:
http://www.microsoft...&displaylang=en
b. Right click the root node and select Connect To
c. Check Select a well known Naming Context check box and select Configuration
d. Click OK
e. Expand ‘Configuration[your.root.domain.name]’ node
f. Right-click the ‘CN=Configuration, DC=…’ node and click Properties
g. Click the Security tab and click Advanced
h. Open the ‘Auditing’ tab and Click Add
i. Type “Everyone” in the box for Enter the object name to select and click OK
j. Select all Successful items except for the following: Full Control, List Contents, Read All Properties and Read Permissions
IMPORTAT: DO NOT click the check box named Apply these auditing entries to objects and/or containers within his container only. Also, make sure the Apply onto selection indicates This object and all child objects.
k. Click OK

I hope I have been of some assistance. Please let me know if you have any further questions or issues.

Sincerely,
Brian Stern

#6 BorisK

BorisK

    Newbie

  • Members
  • Pip
  • 1 posts

Posted 16 November 2016 - 12:47 PM

Êòî ÿ / Who Am I - Kein System ist sicher




0 user(s) are reading this topic

0 members, guests, anonymous users