I have Exchange Server 2007 running on Windows 2003 Standard Edition. I would like to know when a user is removed from a distribution group. I have enabled "Audit account management" and selected "successfull" for the domain. When I go to the Active Directory Computers and Users, to select items to audit.I select thesecurity tab, then adavanced,then select the audit tab, and click add, I add "everyone" and then I am confused by the choices and by the properties tab. What's the properties tab for, and do I need to use it? Which Object items should I select if I only want to monitor when someone is removed from an Exchgange distribution group? Am I doing this correct?

If the "Write Property" is already selected for everyone under auditing tab that is sufficient. if you want more auditing in that case edit the "Write Property" and then under success select "Write All properties"Vinod |CCNA|MCSE 2003 +Messaging|MCTS|ITIL V3|

Hi,To audit for specify Active Directory objects, please refer to the below article:http://support.microsoft.com/kb/814595For the Properties tab, we need to check "Write All properties" option in order to get the Successful or Failed action that you want to audit.ThanksAllen