Splunk® App for Microsoft Exchange

Deploy and Use the Splunk App for Microsoft Exchange

Acrobat logo Download manual as PDF


On October 22 2021, the Splunk App for Microsoft Exchange will reach its end of life. After this date, Splunk will no longer maintain or develop this product. The functionality in this app is migrating to a content pack in Data Integrations. Learn about the Content Pack for Microsoft Exchange.
Acrobat logo Download topic as PDF

Configure Exchange servers

Enable local PowerShell script execution

Like you did for Active Directory and Windows DNS, you must configure the Exchange servers to allow local execution of PowerShell scripts.

All versions of the Windows Server 2008 family after SP2 have PowerShell 2.0 installed by default. All Windows Server 2012 family operating systems have PowerShell 3.0 installed by default. You might need to install Windows Management Framework on Windows Server 2003 family computers.

This procedure tells you how to create a single Group Policy object (GPO) for local PowerShell execution on the Exchange servers. If you want, you can add the Exchange servers to an existing GPO that adds local PowerShell script execution (by adding the Exchange server objects to the GPO you created earlier.)

  1. If required, download Windows Management Framework (http://support.microsoft.com/kb/968929) from Microsoft's Support site and install it.
  2. If required, download the Administrative Templates for Microsoft PowerShell from Microsoft and install them.
  3. Start the Active Directory Users and Computers snap-in.

Create a GPO for local PowerShell execution

  1. Create a new Active Directory GPO. Learn how.
  2. Open the GPO for editing.
  3. In the GPO editor, select Computer Configuration > Policies > Administrative Templates > Windows Components > Windows PowerShell.
  4. Right-click "Turn on script execution", then select "Edit".
  5. In the window that appears, click the "Enabled" radio button.
  6. In the "Execution Policy" drop-down, select Allow local scripts and remote signed scripts.
  7. Click "OK" to accept the changes.
  8. Close the Group Policy Object editor to save your changes.
  9. Deploy the GPO.

GPO updates

After you have deployed the GPOs, it can take up to 120 minutes before Active Directory applies the GPOs to the domain. If you want to deploy the GPOs faster, you must run the GPUPDATE /force command on every computer that you want to update Group Policy.

Adjust the settings for the PowerShell Event log

To ensure that the Splunk App for Microsoft Exchange gets all of the data it needs, adjust the settings for the PowerShell Event log on each Exchange server:

  1. Open Event Viewer.
  2. Right click on PowerShell Log and select Properties.
  3. Set the maximum size to 10,240 kilobytes (kB).
  4. Set Overwrite events as needed under Log size to "When maximum log size is reached".
  5. Click OK to close the dialog.
  6. Right click on the Windows PowerShell Log and select Properties.
  7. Set Overwrite events as needed under Log size to "When maximum log size is reached".
  8. Click OK to close the dialog.

If you need long term storage of the logs, configure a Windows Event log input that indexes the PowerShell event log.

Additional tasks for Exchange servers that hold the Hub and Edge Transport roles

  1. Turn on Message Tracking from within Exchange System Manager.

Enable Exchange Administrator audit logging on Exchange Mailbox Server

If you want to track changes made to Exchange 2010 or 2013 services by Exchange administrators, enable Exchange Administrator audit logging.

Exchange Server 2010 Service Pack 1 and later versions enable administrative audit logging by default.

  1. Open a PowerShell window.
  2. ' In the window, execute the following commands:
    > Set-AdminAuditLogConfig -AdminAuditLogCmdlets *
    > Set-AdminAuditLogConfig -AdminAuditLogParameters *
    > Set-AdminAuditLogConfig -AdminAuditLogEnabled $True
    

    Learn more at Configure Administrator Audit Logging on MS TechNet.

Next step

You have deployed a Group Policy object to enable local PowerShell script execution on your Exchange servers. You have also increased the PowerShell log file size, turned on Message Tracking for Hub and Edge Transport Exchange servers, and turned on Audit Logging for Exchange Mailbox Servers (in Exchange 2010 or 2013 environments.) The next step involves downloading and configuring the Splunk Add-on for Microsoft Exchange.

Download and configure the Splunk Add-ons for Microsoft Exchange

Last modified on 04 April, 2017
PREVIOUS
Sample DNS searches and dashboards
  NEXT
Download and configure the Splunk Add-ons for Microsoft Exchange and prerequisite add-on

This documentation applies to the following versions of Splunk® App for Microsoft Exchange: 3.4.2, 3.4.3, 3.4.4, 3.5.0, 3.5.1, 3.5.2, 4.0.0, 4.0.2, 4.0.3


Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters