Highlighted
enrico.proietti Trusted Contributor.
Trusted Contributor.
507 views

Doubt with Microsoft Exchange PowerShell Smart Connector.

Hi all,
I have a doubt with the Smart Connector in the question; from the Smart Connector Guide, seem that it work with a static list of mailbox users.

What happen in case the number of mailbox users change (deletion or creation of new mailbox user)?

Should I update the deleted/created mailbox manually or there is an automatic process that I can follow?

Can you explain me how it works this kind of smart connector?

Thanks in advance.

Best regards.

Enrico

Labels (3)
0 Likes
Reply
4 Replies
levani Super Contributor.
Super Contributor.

Re: Doubt with Microsoft Exchange PowerShell Smart Connector.

This question is has no answer and can anyone please provide some respond. It is really very interesting how to act and what to do periodically.

Thanks

0 Likes
Reply
stefan.oancea Outstanding Contributor.
Outstanding Contributor.

Re: Doubt with Microsoft Exchange PowerShell Smart Connector.

Hello,

The way the connector is being configured resembles the way that mailbox auditing works within new Exchange Server versions.

In Exchange Server 2010 and higher, mailbox auditing is done and stored at the mailbox level - so somewhere in each user's mailbox. In order for the ArcSight Connector to access those logs, it has to connect to the Exchange Server through PowerShell (hence its name) and query each user's mailbox for new mailbox audit events. That is why within the connector's configuration you have to manually set each user for which you want mailbox auditing to be active.

On the Exchange Server part, as far as I recall you have to do exactly the same thing - activate mailbox auditing for each and every user for which you want it to work.

So basically I guess that if you don't automate the process yourself (some Windows scripting), by default there is no way you can automatically activate mailbox auditing for each user on the Exchange Server's part, nor on the ArcSight Connector - you have to do it manually.

All the best,

Stefan

0 Likes
Reply
skorfulose Absent Member.
Absent Member.

Re: Doubt with Microsoft Exchange PowerShell Smart Connector.

Hello guys,

I'd file a feature request to the ArcSight development. It is easily possible to retrieve a list of all audit-log-enabled mailboxes via PowerShell. So at least on ArcSight-side, there should really be no need for a fixed list.

Regards,

Thomas

0 Likes
Reply
levani Super Contributor.
Super Contributor.

Re: Doubt with Microsoft Exchange PowerShell Smart Connector.

Thanks everybody for respond. It this moment we will set the procedure to add and remove the mailboxes manually.

0 Likes
Reply
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.