SCOM Custom Rule for Exchange Permission Changes
Looking to creat a custome rule to alert when someone is added with fullaccess to someone's mailbox.
The event is generated in the MSExchange Managemenbt event log. Its event id is 1,a dn its informational. Unfortunately event id i is used for many types of exchnage changes. The onbly way to differentiate between the on I want and the other is this: Add-mailboxpermission
in the first line of the event data.
How do I create the rule to capute this? Nothing I try seems to work.