How to Audit Privileged Operations and Mailbox Access in Office 365 Exchange Online
•
1 recomendación•1,117 vistas
Focusing on auditing mailbox activity such as administration operations and non-owner mailbox access, Randy took customers through the native capabilities through PowerShell and the Office 365 portal. Bryan Patton then shows how Change Auditor for Exchange made it easy for customers to be able to audit mailbox activity whether on premise Exchange or Exchange Online, and how having a 3rd party solution fills the gaps of native capabilities. Watch the webcast here: http://bit.ly/2hkbKPb.
Recomendados
Recomendados
Más contenido relacionado
La actualidad más candente
La actualidad más candente (20)
Similar a How to Audit Privileged Operations and Mailbox Access in Office 365 Exchange Online
Similar a How to Audit Privileged Operations and Mailbox Access in Office 365 Exchange Online (20)
Más de Quest
Más de Quest (20)
Último
Último (20)
How to Audit Privileged Operations and Mailbox Access in Office 365 Exchange Online
- 1. Sponsored by HowtoAuditPrivilegedOperations and MailboxAccessinOffice 365 ExchangeOnline © 2016 Monterey Technology Group Inc.
- 2. Thanks to Made possible by
- 3. Preview of key points Types of activity to audit in Exchange Online Message tracking Privileged access (admin) Non-owner Mailbox access Using PowerShell to manage auditing in ExchangeOnline
- 4. Exchange Online Run PowerShell as Admin Set-ExecutionPolicy RemoteSigned $UserCredential = Get-Credential $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection Import-PSSession $Session
- 5. Message tracking Message flow Who is emailing who? Get-MessageTrace https://blogs.technet.microsoft.com/eopfieldnotes/2014/12/16/ message-trace-the-powershell-way/ http://o365info.com/performing-an-extended-message-trace-in- office-365/
- 6. Admin operations Exporting mailboxes Granting permissions Setting up forwarding rules Everything an admin does in Exchange is ultimately a PowerShell command Exchange audit’s admin activity at the PowerShell level Enable for entire organization with Set-AdminAuditLogConfig -AdminAuditLogEnabled $true - AdminAuditLogCmdlets * -AdminAuditLogParameters * - AdminAuditLogExcludedCmdlets *Mailbox*, *TransportRule*
- 7. Admin operations Log via PowerShell Interactive: Search-AdminAuditLog Not details Wait for email: New-AdminAuditLogSearch Limited in result size Log via Portal Limited to pre-conceived search scenarios Limited in result size
- 8. Non-Owner Mailbox Auditing When does Bob access Alice’s mailbox to View her email Send email as her Delete email Track that with mailbox auditing Must enable via PowerShell for each mailbox Set-Mailbox -Identity "John Smith" -AuditDelegate SendAs,SendOnBehalf,MessageBind,FolderBind -AuditEnabled $true
- 9. Non-Owner Mailbox Auditing Action Administrator Delegate Owner Copy • n/a n/a Create • • • FolderBind • • • HardDelete • • • MessageBind • n/a n/a Move • • • MoveToDeletedIt ems • • • SendAs • • n/a SendOnBehalf • • n/a SoftDelete • • • Update • • •
- 10. Non-Owner Mailbox Auditing Don’t enable –AuditOwner Don’t distinguish between –AuditDelegate and –AuditAdmin Always enable both Most things an admin does are logged as delegate Bogus events being triggered by some automated process? Set-MailboxAuditBypassAssociation
- 11. Non-Owner Mailbox Auditing How to get mailbox audit logs out? This is complicated
- 12. Non-Owner Mailbox Auditing How to get mailbox audit logs out? Does not meet requirements Search-MailboxAuditLog The old way New-SearchMailboxAuditLog No longer works on Exchange 2016 or Exchange Online because of severe limitations Examples
- 13. Non-Owner Mailbox Auditing Portal Only useful for casual, targeted querying of recent activity Can’t search users What does work? O365 Management Activity API Requires significant application programming Check out Quest Change Auditor coming up
- 14. Bottom line Office 365 captures the audit data If you have a specific case you want to research, you can probably find the activity using the online portal If you want enterprise logging for compliance and security Long term archival Powerful, comprehensive search Alerting Correlation with other activity feeds You need more than base functionality CheckoutQuest ChangeAuditor © 2016 Monterey Technology Group Inc.
- 15. Change Auditor – Office 365 Exchange Bryan Patton, CISSP
- 16. Confidential16 Change Auditor • Active Directory / LDS • Azure Active Directory • Active Directory Queries • Logon, Logoff, User Sessions • Exchange • O365 Exchange Online • SQL Server • SharePoint • Skype for Business • Windows File Servers • EMC Celerra, Isilon • NetApp • Dell Fluid File System • Quest GPOADmin • Quest Active Roles • Quest Authentication Services • Quest Defender Object protection
- 17. Confidential17 • Change Auditor provides complete, real-time change auditing, in-depth forensics and comprehensive reporting on all key configuration, user and administrator changes Change Auditor Who Made the change? Where Was the change made from? What Object was changed? When Was the change made? Why Was the change made (comment)? Workstation Where the change originated from Real-time smart alerts to any device
- 18. Demonstration