- Open Exchange Administrative Console in Internet Explorer → Navigate to "Compliance management" → Choose "Auditing" → Choose "Run the admin audit log report…"
- Choose a start date and end date → Click "Search".
You will see all configuration changes made during the specified time period. - Sort the list by cmdlet and find "Add-PublicFolderPermission" → Click on it for details.
- You will see who changed permissions ("User"), which public folder permissions were changed and how ("Parameters").
Report Sample
- Run Netwrix Auditor → Navigate to "Search" → Choose "Advanced" and specify the following criteria:
- Filter – "Data Source";
Operator – "=(Equals)";
Value – "Exchange Online" - Filter – "Object type";
Operator – "Contains";
Value – "Public Folder" - Filter – "Details";
Operator – "Contains";
Value – "Access Rights"
- Filter – "Data Source";
- Select "Modify" → Click "Search".
After that, you will see which public folder permissions were modified, who did that and when it was done.
Report Sample