Hero Banner

Modern Workplace Discussions

Discuss best practices related to Security, Teamwork and Unified Endpoint Management (Microsoft 365).

Reply
Lonwa
Level 1 Contributor

SCOM Custom Rule for Exchange Permission Changes

Looking to creat a custome rule to alert when someone is added with fullaccess to someone's mailbox.

 

The event is generated in the MSExchange Managemenbt event log. Its event id is 1,a dn its informational. Unfortunately event id i is used for many types of exchnage changes. The onbly way to differentiate between the on I want and the other is this: Add-mailboxpermission

 

in the first line of the event data.

 

How do I create the rule to capute this? Nothing I try seems to work.

 

Thanks

 

Lonwa

1 REPLY 1
Lonwa
Level 1 Contributor

Anyone?