Details

A message tracking log provides a detailed log of all message activity as messages are transferred to and from a computer running Exchange.

If events are not recorded, it may be difficult or impossible to determine the root cause of system problems or the unauthorized activities of malicious users.

Solution

Open the Exchange Management Shell and enter the following command:

Set-TransportService -Identity <'IdentityName'> – MessageTrackingLogEnabled $True

Note: The value must be in quotes.

Supportive Information

The following resource is also helpful.

• https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Exchange_2013_Y21M01_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: Audit and Accountability.This control applies to the following type of system Windows.

References

• 800-53|AU-3
• CAT|II
• CCI|CCI-000133
• Rule-ID|SV-207275r615936_rule
• STIG-ID|EX13-MB-000045
• STIG-Legacy|SV-84579
• STIG-Legacy|V-69957
• Vuln-ID|V-207275

Source

• Tenable.com/audits