Microsoft KB Archive/188671

= XADM: How to Determine When Permissions Have Been Altered in Exchange =

Article ID: 188671

Article Last Modified on 10/28/2006

-

APPLIES TO


 * Microsoft Exchange Server 5.5 Standard Edition

-



This article was previously published under Q188671



SUMMARY
This article explains how an Exchange administrator can determine when permissions have been modified on the Organization, Site, or Configuration objects in the Exchange Administrator program.



MORE INFORMATION
The following event appears in the application log of the event viewer after an administrator has modified the permissions on one of these objects:   Event ID 1175 Source MSExchangeDS Type Information Category Security With the following descriptions:


 * If the change is made at the Organizational level: Description: The Security attributes of object /o= were modified.
 * If the change is made at the Site level: Description: The Security attributes of object /o=/ou= were modified.
 * If the change is made at the Configuration level: Description: The Security attributes of object /o=/ou=/cn=Configuration were modified.

With diagnostic logging set to Maximum on "Security" in the properties of Directory Service/Diagnostic Logging, the following event is logged:

  Event ID 1053 Source MSExchangeDS Type Information Category Security

With the following descriptions:


 * If the change is made at the Organizational level: Description: The security descriptor granted 0x80 access on object /o= for this user.
 * If the change is made at the Site level: Description: The security descriptor granted 0x80 access on object /o=/ou= for this user.
 * If the change is made at the Configuration level: Description: The security descriptor granted 0x80 access on object /o=/ou=/cn=Configuration for this user.

In the previous Events, "admin" permissions were granted to a user; this equals "0x80" in the description. This number varies depending on which permissions were modified.

The description does not state which user made the modification to the objects; however, in the application log under the USER column, it states which user caused the event to be generated.

Keywords: kbhowto KB188671

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.