Admin Audit Events (Administrator Audit Logging)

File Access Manager features the following Admin audit events:

1. General Admin audit events are assigned to a special resource (Audit Admin).

2. Admin audit events that relate to a specific mailbox are assigned to the mailbox business resource.

   • The list of commands can be found in the framework configuration file in the mailboxAuditLogCmdLets setting.

     For Exchange: The config file is WBX.Exchange2010BAMHost.dll.config

     For Exchange Online it is WBX.ExchangeOnlineBAMHost.dll.config

   • By default, the following are defined as mailbox commands:
   • Remove-Mailbox
   • New-Mailbox
   • Set-Mailbox
   • Add-MailboxPermission
   • Remove-MailboxPermission
   • Set-MailboxAutoReplyConfiguration
3. Admin audit events related to a specific mailbox folder are assigned to the mailbox folder business resource.
• The list of commands can be found in the BAMFramework.exe.config file in the mailboxFolderAuditLogCmdLets setting.
• By default, the following are defined as mailbox folder commands:
• Add-MailboxFolderPermission
• Remove-MailboxFolderPermission
• Set-MailboxFolderPermission
4. Admin audit events related to a specific public folder are assigned to the public folder business resource.
• The list of commands can be found in the BAMFramework.exe.config file in the publicFolderAuditLogCmdLets setting.
• By default, the following commands are defined as public folder commands:
• Add-PublicFolderClientPermission
• Remove-PublicFolderClientPermission
• New-PublicFolder
• Remove-PublicFolder
• Add-PublicFolderAdministrativePermission
• Remove-PublicFolderAdministrativePermission