Guide to the Secure Configuration and Administration of Microsoft ...

MSExchangeIS/Public object. It is recommended to log the following at the
“maximum” level:
Logons
Access Control
Send On Behalf Of
Send As
Download
Use the Windows NT event viewer to view logged events.
Message Transfer Agent
Site Level
Server Level
The Message Transfer Agent routes messages between Exchange servers. The
Message Transfer Agent is used anytime a message has to go off a server.
The Message Transfer Agent is managed at both the site and server levels in the
Exchange Administrator where, from a security perspective, two items are of interest –
message tracking and diagnostic logging. Message tracking and diagnostic logging for
the Message Transfer Agent are identical in concept to that of the Directory Store and
Information Store.
Message tracking is enabled at the site level in the Exchange Administrator:
Select the MTA Site Configuration object from within the configuration object, and
then select File/Properties. Message tracking is enabled from the “General Tab.”
Message transfer agent diagnostic logging levels are administered from the server level
in the Exchange Administrator:
Select the Message Transfer Agent object from the appropriate server object, and
then select File/Properties and the “Diagnostic Logging” tab. It is recommended to
log the following at the “maximum” level:
Security
20