JSI Tip 1273. Implement download logging for Exchange.

You can cause Microsoft Exchange Server to log an event when a user moves or copies objects from the private or public information store to another store, such as a Personal Folder.

When you implement logging, the following data is logged:

User name
Mailbox name
Size of item downloaded
Document type
Document identifier

Here is a sample entry:

   Event ID: 7102
   Type: Information
   Source: MSExchangeIS Private
   Category: Download
   Description:

   User WinNT_Domain\User (mailbox
   /o=Org /ou=Site /cn=Recipients /cn=Mailbox) downloaded 
   2127271 bytes from attachment 
   c7e20a0c4-9762-11d1-a487-00c04fc29f3e-b8a1

To implement logging, use Regedt32 to navigate to:

HKEY_LOCAL_ MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS

Double-click the MSExchangeIS key.

To log public folder downloads, select ParametersPublic.

To log private mailbox downloads, select ParametersPrivate.

On the Edit menu, Add Value name Log Downloads as a type REG_DWORD.

Set the data value per the following:

    To log downloads from      Data

    Attachments only           1   
    Messages only              2   
    Attachments and messages   3   
    Folders only               4   
    Attachments and folders    5   
    Messages and folders       6   
    All                        7

NOTE: You may add Log Downloads to both ParametersPublic and ParametersPrivate.