I have Exchange 2007 SP3 RU1 on all of my exchange servers. Our Domain is Windows 2003 native mode. All Exchange servers are running on Windows 2008. Is there a way to audit who makes changes to an Exchange mailbox? For example I had a very sensitive mailbox in Exchange and "Hide from address lists" was enabled so the mailbox was not visable in the address lists. Some one changed it so it is now visable. I need to figure out whao made the change. What are my options?

There is no built in Tool or Technology in Exchange 2007 SP3 which can tell you that who enabled it. You can enable the auditing on the server so that you will come to know who accessed the mailbox. http://technet.microsoft.com/en-us/library/ee221156(EXCHG.80).aspx To achieve what you are looking for, you will have to check with some third party Tools.Gulab | Skype: gulab.mallah

There is no built in Tool or Technology in Exchange 2007 SP3 which can tell you that who enabled it. You can enable the auditing on the server so that you will come to know who accessed the mailbox. http://technet.microsoft.com/en-us/library/ee221156(EXCHG.80).aspx To achieve what you are looking for, you will have to check with some third party Tools.Gulab | Skype: gulab.mallah

Gulab’s right. Per my research, there is no official tool to audit the changes of exchange-related attributes Please try to audit the “msExchMailboxSecurityDescriptor” on the DC, which may reveal the changes (Reference)Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.