Event Details
Operating System->Microsoft Windows->Application logs->Quest->Change Auditor->Change Auditor for Exchange->Permissions change->EventID 201 - User modified folder permissions in owner mailbox.
EventID 201 - User modified folder permissions in owner mailbox.
 Sample:
Event Type:     SuccessAudit
Event Source:   InTrust for Exchange
Event Category: Permissions change
Event ID:       201
Date:           11/9/2009
Time:           07:14:32
User:           RESEARCH\DKrane
Computer:       DC1
Description:    
User modified folder permissions in owner mailbox:

	User Name: DKrane 

	User Domain: research.corp 

	Mailbox Name: Daniel Krane 

	Mailbox legacyExchangeDN: /o=Research corp/ou=First Administrative Group/cn=Recipients/cn=DKrane 

	Client IP: 10.0.0.2 

	Folder Name: Calendar 

	Folder Path: / 

	To Account: NT AUTHORITY\ANONYMOUS LOGON 

	New Permissions: 

		Create items: %N/A 

		Read items: %N/A 

		Create subfolders: %N/A 

		Folder owner: %N/A 

		Folder contact: %N/A 

		Folder visible: %N/A 

		Edit items: %N/A 

		Delete items: %N/A 

	Old Permissions: 

		Create items: %false 

		Read items: %false 

		Create subfolders: %false 

		Folder owner: %false 

		Folder contact: %false 

		Folder visible: %false 

		Edit items: %none 

		Delete items: %none 
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: InTrust for Exchange
Filtering Field Equals to Value
Category ITEX:Permissions change
Source InTrust for Exchange
EventId 201
Field Matching
FieldDescriptionStored inSample Value
DateTime Date/Time of event origination in GMT format. DateTime 10.10.2000 19:00:00
Source Name of an Application or System Service originating the event. Source Security
Type Warning, Information, Error, Success, Failure, etc. Type Success
User Domain\Account name of user/service/computer initiating event. User RESEARCH\Alebovsky
Computer Name of server workstation where event was logged. Computer DC1
EventID Numerical ID of event. Unique within one Event Source. EventId 576
Description The entire unparsed event message. Description Special privileges assigned to new logon.
Log Name The name of the event log (e.g. Application, Security, System, etc.) LogName Security
Category A name for a subclass of events within the same Event Source. Category AttestationReview
User Name InsertionString1 ALebovsky
User Domain InsertionString2 research.corp
Mailbox Name InsertionString3 Daniel Krane
Mailbox legacyExchangeDN InsertionString6 /o=Research corp/ou=First Administrative Group/cn=Recipients/cn=DKrane
Client IP InsertionString8 10.0.0.1
Folder Name InsertionString10 Calendar
Folder Path InsertionString12 /
To Account InsertionString13 NT AUTHORITY\ANONYMOUS LOGON
New Permissions: Create items InsertionString14 %false
New Permissions: Read items InsertionString15 %false
New Permissions: Create subfolders InsertionString16 %false
New Permissions: Folder owner InsertionString17 %false
New Permissions: Folder contact InsertionString18 %false
New Permissions: Folder visible InsertionString19 %false
New Permissions: Edit items InsertionString20 %none
New Permissions: Delete items InsertionString21 %none
Old Permissions: Create items InsertionString24 %false
Old Permissions: Read items InsertionString25 %false
Old Permissions: Create subfolders InsertionString26 %false
Old Permissions: Folder owner InsertionString27 %false
Old Permissions: Folder contact InsertionString28 %false
Old Permissions: Folder visible InsertionString29 %false
Old Permissions: Edit items InsertionString30 %none
Old Permissions: Delete items InsertionString31 %none
Comments
You must be logged in to comment