Exchange Server is modifying GPOs in AD

ImedJrad-7062 40

Hello Everyone,

in our SIEM, we are getting more than 300 incident a day that a GPO has been modified by the exchange server machine account and the Property Name: msExchMailboxAuditLastAdminAccess.

Can anyone please explain this incident, and give us tips on if we should ignore it or if we should some changes on Exchange or AD server.

Thanks

Jake Zhang-MSFT 7,230 Reputation points Microsoft Vendor

2024-05-14T05:10:26.61+00:00

Hi @I-med,

Just circling back to check to see how things are going on with this thread. Should you need more help on this, you can feel free to post back.
ImedJrad-7062 40 Reputation points

2024-05-21T11:05:53.9133333+00:00

Hello @Jake Zhang-MSFT ,

thanks for asking, no the issue is still there

Accepted answer

Jake Zhang-MSFT 7,230 Reputation points Microsoft Vendor

2024-05-23T09:49:38.72+00:00

Hi @I-med,

Thanks for your response.

As Andy David said, mailbox auditing is enabled by default. 'msExchMailboxAuditLastAdminAccess' is the name of an Active Directory property. This property is used to record the last time an administrator accessed the Exchange mailbox. This value will change when the administrator accesses the mailbox. If it does not affect your normal use of Exchange Server, it is recommended that you ignore the change in this value.

Please feel free to contact me if you have any queries.

Best,

Jake Zhang
Please sign in to rate this answer.

1 person found this answer helpful.
Jake Zhang-MSFT 7,230 Reputation points Microsoft Vendor

2024-05-28T06:25:43.65+00:00

Hi @I-med,

Just wanted to check if the answer shared below helped. If it helped, then would request you to please "Accept the answer" as it would be helpful to others in the community as well. Thanks for your understanding.

Best,

Jake Zhang

Jake Zhang-MSFT 7,230 Reputation points Microsoft Vendor

2024-05-29T10:07:20.73+00:00

Hi @I-med,

I would like to know if the problem has been solved. If you still have questions, please feel free to leave me a comment so that I can help you.

Best,

Jake Zhang

ImedJrad-7062 40 Reputation points

2024-05-29T11:15:53.68+00:00

Hi @Jake Zhang-MSFT ,

this was very helpful.

Thank you .

BR,

Imed
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

1 additional answer

Andy David - MVP 150K Reputation points MVP

2024-05-10T11:01:48.0966667+00:00

Mailbox Auditing is enabled by default so that is prob expected. What exactly is getting changed according the alerts?
Please sign in to rate this answer.
ImedJrad-7062 40 Reputation points

2024-05-21T11:13:42.0966667+00:00

Hi @Andy David - MVP ,

Thanks for your reply.

it changes the Property Value each time
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Exchange Server is modifying GPOs in AD

1 additional answer

Your answer