| Event Id | 7102 |
| Source | MSExchangeIS Private |
| Description | User WinNT_Domain\User (mailbox /o=Org /ou=Site /cn=Recipients /cn=Mailbox) downloaded 2127271 bytes from attachment c7e20a0c4-9762-11d1-a487-00c04fc29f3e-b8a1 |
| Event Information | According to Microsoft: You establish download logging by editing the registry of a Microsoft Exchange Server with RegEdit, a Windows NT administrative tool. The values you add apply to all public and private folders on the server. To start download logging: 1. Start Registry Editor (Regedt32.exe or Regedit.exe as appropriate for your version of Windows NT). 2. Go to the following key in the registry: HKEY_LOCAL_ MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS 3. Select ParametersPublic to log downloads from public folders. Select ParametersPrivate to log downloads from private mailboxes. 4. On the Edit menu, click Add Value and use the following entry: Value Name: Log Downloads Data Type: REG_DWORD |
| Reference Links | XADM: Exchange Server Download Logging Feature |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.