Event Details
User Activity->Permission Changes->Exchange Object Permission Changes->InTrust Plug-in for Exchange->Non-owner Permission Changes->EventID 200 - User modified folder permissions in another user's mailbox.
EventID 200 - User modified folder permissions in another user's mailbox.
 Sample:
Event Type:     SuccessAudit
Event Source:   InTrust for Exchange
Event Category: Permissions change
Event ID:       200
Date:           11/9/2009
Time:           10:10:58
User:           RESEARCH\ALebovsky
Computer:       DC1
Description:    
User modified folder permissions in another user's mailbox:

	User Name: ALebovsky 

	User Domain: research.corp 

	User Displayname: Alex Lebovsky 

	Mailbox Name: Daniel Krane 

	Owner Name: DKrane 

	Owner Domain: research.corp 

	Mailbox legacyExchangeDN: /o=Research corp/ou=First Administrative Group/cn=Recipients/cn=DKrane 

	Client IP: 10.0.0.1 

	Folder Name: Calendar 

	Folder Path: / 

	To Account: RESEARCH\CBrown 

	New Permissions: 

		Create items: N/A 

		Read items: N/A 

		Create subfolders: N/A 

		Folder owner: N/A 

		Folder contact: N/A 

		Folder visible: N/A 

		Edit items: N/A 

		Delete items: N/A 

	Old Permissions: 

		Create items: true 

		Read items: true 

		Create subfolders: false 

		Folder owner: false 

		Folder contact: false 

		Folder visible: true 

		Edit items: all 

		Delete items: all 
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: InTrust for Exchange
Filtering Field Equals to Value
Category ITEX:Permissions change
Source InTrust for Exchange
EventId 200
Field Matching
FieldDescriptionStored inSample Value
When At what date and time a user activity originated in the system. DateTime 10.10.2000 19:00:00
Who Account or user name under which the activity occured. User Name ALebovsky
What The type of activity occurred (e.g. Logon, Password Changed, etc.) "Exchange Object Permission Change" Exchange Object Permission Change
Where The name of the workstation/server where the activity was logged. Computer DC1
Where From The name of the workstation/server where the activity was initiated from. Client IP 10.0.0.1
Severity Specify the seriousness of the event. "High" High
WhoDomain -
WhereDomain -
Object Type The type of object whose permissions were changed (e.g. AD object, file, registry, etc.) "Folder" Folder
Object Name The name of the object whose permissions were changed (e.g. full system path to the file or folder) Folder Name Calendar
To Whom Account whose access permissions to the object were changed To Account RESEARCH\CBrown
Whose The name of the account owning the mailbox which permissions were changed Owner Name DKrane
Comments
You must be logged in to comment