Event Details
User Activity->Permission Changes->Exchange Object Permission Changes->InTrust Plug-in for Exchange->Owner Permissions Changes->EventID 201 - User modified folder permissions in owner mailbox.
EventID 201 - User modified folder permissions in owner mailbox.
 Sample:
Event Type:     SuccessAudit
Event Source:   InTrust for Exchange
Event Category: Permissions change
Event ID:       201
Date:           11/9/2009
Time:           07:14:32
User:           RESEARCH\DKrane
Computer:       DC1
Description:    
User modified folder permissions in owner mailbox:

	User Name: DKrane 

	User Domain: research.corp 

	Mailbox Name: Daniel Krane 

	Mailbox legacyExchangeDN: /o=Research corp/ou=First Administrative Group/cn=Recipients/cn=DKrane 

	Client IP: 10.0.0.2 

	Folder Name: Calendar 

	Folder Path: / 

	To Account: NT AUTHORITY\ANONYMOUS LOGON 

	New Permissions: 

		Create items: N/A 

		Read items: N/A 

		Create subfolders: N/A 

		Folder owner: N/A 

		Folder contact: N/A 

		Folder visible: N/A 

		Edit items: N/A 

		Delete items: N/A 

	Old Permissions: 

		Create items: false 

		Read items: false 

		Create subfolders: false 

		Folder owner: false 

		Folder contact: false 

		Folder visible: false 

		Edit items: none 

		Delete items: none 
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: InTrust for Exchange
Filtering Field Equals to Value
Category ITEX:Permissions change
Source InTrust for Exchange
EventId 201
Field Matching
FieldDescriptionStored inSample Value
When At what date and time a user activity originated in the system. DateTime 10.10.2000 19:00:00
Who Account or user name under which the activity occured. User Name ALebovsky
What The type of activity occurred (e.g. Logon, Password Changed, etc.) "Exchange Object Permission Change" Exchange Object Permission Change
Where The name of the workstation/server where the activity was logged. Computer DC1
Where From The name of the workstation/server where the activity was initiated from. Client IP 10.0.0.1
Severity Specify the seriousness of the event. "High" High
WhoDomain -
WhereDomain -
Object Type The type of object whose permissions were changed (e.g. AD object, file, registry, etc.) "Folder" Folder
Object Name The name of the object whose permissions were changed (e.g. full system path to the file or folder) Folder Name Calendar
To Whom Account whose access permissions to the object were changed To Account NT AUTHORITY\ANONYMOUS LOGON
Comments
You must be logged in to comment