Exchange Server is modifying GPOs in AD

Question

Exchange Server is modifying GPOs in AD

ImedJrad-7062 40

Hello Everyone,

in our SIEM, we are getting more than 300 incident a day that a GPO has been modified by the exchange server machine account and the Property Name: msExchMailboxAuditLastAdminAccess.

Can anyone please explain this incident, and give us tips on if we should ignore it or if we should some changes on Exchange or AD server.

Thanks

Anonymous

2024-05-14T05:10:26.61+00:00

Hi @I-med,

Just circling back to check to see how things are going on with this thread. Should you need more help on this, you can feel free to post back.
ImedJrad-7062 40 Reputation points

2024-05-21T11:05:53.9133333+00:00

Hello @Anonymous ,

thanks for asking, no the issue is still there

Accepted answer

1 additional answer

Your answer

Anonymous

2024-05-14T05:10:26.61+00:00

Hi @I-med,

Just circling back to check to see how things are going on with this thread. Should you need more help on this, you can feel free to post back.
ImedJrad-7062 40 Reputation points

2024-05-21T11:05:53.9133333+00:00

Hello @Anonymous ,

thanks for asking, no the issue is still there

Answer 1

Anonymous

Hi @I-med,

Thanks for your response.

As Andy David said, mailbox auditing is enabled by default. 'msExchMailboxAuditLastAdminAccess' is the name of an Active Directory property. This property is used to record the last time an administrator accessed the Exchange mailbox. This value will change when the administrator accesses the mailbox. If it does not affect your normal use of Exchange Server, it is recommended that you ignore the change in this value.

User's image

Please feel free to contact me if you have any queries.

Best,

Jake Zhang

Anonymous

2024-05-28T06:25:43.65+00:00

Hi @I-med,

Just wanted to check if the answer shared below helped. If it helped, then would request you to please "Accept the answer" as it would be helpful to others in the community as well. Thanks for your understanding.

Best,

Jake Zhang
Anonymous

2024-05-29T10:07:20.73+00:00

Hi @I-med,

I would like to know if the problem has been solved. If you still have questions, please feel free to leave me a comment so that I can help you.

Best,

Jake Zhang
ImedJrad-7062 40 Reputation points

2024-05-29T11:15:53.68+00:00

Hi @Anonymous ,

this was very helpful.

Thank you .

BR,

Imed

Answer 2

Andy David - MVP 157.8K MVP Volunteer Moderator

Mailbox Auditing is enabled by default so that is prob expected. What exactly is getting changed according the alerts?

ImedJrad-7062 40 Reputation points

2024-05-21T11:13:42.0966667+00:00

Hi @Andy David - MVP ,

Thanks for your reply.

it changes the Property Value each time

Share via

Exchange Server is modifying GPOs in AD

1 additional answer

Your answer