Configure Exchange servers

Enable local PowerShell script execution

Like you did for Active Directory and Windows DNS, you must configure the Exchange servers to allow local execution of PowerShell scripts.

All versions of the Windows Server 2008 family after SP2 have PowerShell 2.0 installed by default. All Windows Server 2012 family operating systems have PowerShell 3.0 installed by default. You might need to install Windows Management Framework on Windows Server 2003 family computers.

This procedure tells you how to create a single Group Policy object (GPO) for local PowerShell execution on the Exchange servers. If you want, you can add the Exchange servers to an existing GPO that adds local PowerShell script execution (by adding the Exchange server objects to the GPO you created earlier.)

1. If required, download Windows Management Framework (http://support.microsoft.com/kb/968929) from Microsoft's Support site and install it.
2. If required, download the Administrative Templates for Microsoft PowerShell from Microsoft and install them.
3. Start the Active Directory Users and Computers snap-in.

Create a GPO for local PowerShell execution

1. Create a new Active Directory GPO. Learn how.
2. Open the GPO for editing.
3. In the GPO editor, select Computer Configuration > Policies > Administrative Templates > Windows Components > Windows PowerShell.
4. Right-click "Turn on script execution", then select "Edit".
5. In the window that appears, click the "Enabled" radio button.
6. In the "Execution Policy" drop-down, select Allow local scripts and remote signed scripts.
7. Click "OK" to accept the changes.
8. Close the Group Policy Object editor to save your changes.
9. Deploy the GPO.

GPO updates

After you have deployed the GPOs, it can take up to 120 minutes before Active Directory applies the GPOs to the domain. If you want to deploy the GPOs faster, you must run the GPUPDATE /force command on every computer that you want to update Group Policy.

Adjust the settings for the PowerShell Event log

To ensure that the Splunk App for Microsoft Exchange gets all of the data it needs, adjust the settings for the PowerShell Event log on each Exchange server:

1. Open Event Viewer.
2. Right click on PowerShell Log and select Properties.
3. Set the maximum size to 10,240 kilobytes (kB).
4. Set Overwrite events as needed under Log size to "When maximum log size is reached".
5. Click OK to close the dialog.
6. Right click on the Windows PowerShell Log and select Properties.
7. Set Overwrite events as needed under Log size to "When maximum log size is reached".
8. Click OK to close the dialog.

If you need long term storage of the logs, configure a Windows Event log input that indexes the PowerShell event log.

Additional tasks for Exchange servers that hold the Hub and Edge Transport roles

1. Turn on Message Tracking from within Exchange System Manager.

Enable Exchange Administrator audit logging on Exchange Mailbox Server

If you want to track changes made to Exchange 2010 or 2013 services by Exchange administrators, enable Exchange Administrator audit logging.

Exchange Server 2010 Service Pack 1 and later versions enable administrative audit logging by default.

1. Open a PowerShell window.
2. ' In the window, execute the following commands:
   

   > Set-AdminAuditLogConfig -AdminAuditLogCmdlets *
   > Set-AdminAuditLogConfig -AdminAuditLogParameters *
   > Set-AdminAuditLogConfig -AdminAuditLogEnabled $True
   

   
   Learn more at Configure Administrator Audit Logging on MS TechNet.

Next step

You have deployed a Group Policy object to enable local PowerShell script execution on your Exchange servers. You have also increased the PowerShell log file size, turned on Message Tracking for Hub and Edge Transport Exchange servers, and turned on Audit Logging for Exchange Mailbox Servers (in Exchange 2010 or 2013 environments.) The next step involves downloading and configuring the Splunk Add-on for Microsoft Exchange.

Download and configure the Splunk Add-ons for Microsoft Exchange