Share via

How to Change Exchange Auditing Logging Levels

  • Article

Microsoft Exchange Server 2007 will reach end of support on April 11, 2017. To stay supported, you will need to upgrade. For more information, see Resources to help you upgrade your Office 2007 servers and clients.

 

Applies to: Exchange Server 2007 SP1, Exchange Server 2007 SP2, Exchange Server 2007 SP3

This topic explains how to use the Exchange Management Console and the Exchange Management Shell to modify Exchange Auditing logging levels.

You can use the Exchange Management Console to set Exchange Auditing logging level 0, 1, 3, or 5. To set Exchange Auditing levels 2 or 4, you must use the Exchange Management Shell.

Before You Begin

To perform this procedure, the account you use must be delegated the following:

  • Local Administrator rights

  • Exchange Organization Administrators rights

For more information about permissions, delegating roles, and the rights that are required to administer Exchange Server 2007, see Permission Considerations.

Procedure

To use the Exchange Management Console to set logging level 0, 1, 3, or 5

  1. Start the Exchange Management Console.

  2. Expand Server Configuration, and then click Mailbox.

  3. In the details pane, right-click the Mailbox server for which you want to set Exchange Auditing, and then click Manage Diagnostics Logging Properties.

  4. Expand MSExchangeIS, and then expand 9000 Private.

  5. Click one of the following items, as appropriate for the logging that you want to perform:

    • Message Access

    • Folder Access

    • Extended Send As

    • Extended Send On Behalf Of

  6. Click one of the following logging levels, as appropriate for the logging level that you want to set:

    Logging level Setting

    0

    Lowest

    1

    Low

    3

    Medium

    5

    High

  7. Repeat steps 5 and 6 for each item that you want to audit.

  8. Click Configure, and then click Finish.

  9. Stop and then start the Microsoft Exchange Information Store service.

To use the Exchange Management Shell to set logging level 2 or 4

  1. Start the Exchange Management Shell, and then run the following command:

    Set-Location "HKLM:\System\CurrentControlSet\Services\MSExchangeIS\Diagnostics\9000 Private"

  2. Run the following command to list the logging levels that are currently set:

    Get-ItemProperty .

  3. To modify a logging level, such as the Message Access logging level, run a command that resembles the following:

    Set-ItemProperty -Path . -Name "9075 Message Access" -Value 2

  4. Stop, and then start the Microsoft Exchange Information Store service.

For detailed syntax and parameter information, see Set-ItemProperty.

For More Information

For more information about Exchange Auditing, see Understanding Mailbox Access Auditing with Exchange Server 2007 Service Pack 3.

For more information about diagnostics logging of Exchange processes, see Diagnostic Logging of Exchange Processes and How to Change Logging Levels for Exchange Processes.

For more information about how to modify diagnostics logging levels in Exchange, see How to Change Logging Levels for Exchange Processes.