Exchange 2013 Diagnoselogging

Das Diagnoseprotokoll ist eine der Einstellungen, die noch NICHT über das Exchange Control panel steuerbar sind. Ich erwarte aber auch nicht, dass dies mal kommt, da diese Einstellung immer "pro Server" ist und nicht pro Kunde. Und selbst dann wird man über das ECP ja kaum an die Eventlogeinträge kommen. Das bleibt also eine Tätigkeit für Administratoren, die dies dann auf dem Server per PowerShell aktivieren und die Eventlogs auswerten.

Eventlog Level anzeigen und einstellen

Bezüglich der Konfiguration hat sich seit Exchange 2007 nicht viel geändert. Die PowerShell Befehle sind zum Anzeigen und Setzen die seit Exchange 2007 unverändert:

• Set-EventLogLevel
  Exchange 2013 http://technet.microsoft.com/de-de/library/aa998905(v=exchg.150).aspx
  Exchange 2010 http://technet.microsoft.com/de-de/library/aa998905(v=exchg.141).aspx
  Exchange 2007 http://technet.microsoft.com/de-de/library/aa998905(v=exchg.80).aspx
• Get-EventLogLevel
  Exchange 2013 http://technet.microsoft.com/de-DE/library/bb125129(v=exchg.150).aspx
  Exchange 2010 http://technet.microsoft.com/de-DE/library/bb125129(v=exchg.141).aspx
  Exchange 2007 http://technet.microsoft.com/de-DE/library/bb125129(v=exchg.80).aspx

In Exchange 2007 und 2010 konnte ein Administrator die Einstellung auch über die GUI vornehmen (Siehe Diagnoseprotokoll Ex 200x)

Default-Werte einstellen

Mit dem Wegfall der GUI in Exchange 2013 ist leider auch die Option entfallen, die Default-Werte wieder herzustellen:

Insofern sollte man sich vielleicht mal die Defaults niederschreiben. Hier die Standardeinstellungen eines Exchange 2013 RTM-Servers. (MB und CAS zusammen):

[PS] C:\>Get-EventLogLevel

Identity                                                                 EventLevel
--------                                                                 ----------
MSExchange ActiveSync\Requests                                           Lowest
MSExchange ActiveSync\Configuration                                      Lowest
MSExchange Antispam\General                                              Lowest
MSExchange Assistants\Assistants                                         Lowest
MSExchange Autodiscover\Core                                             Lowest
MSExchange Autodiscover\Web                                              Lowest
MSExchange Autodiscover\Provider                                         Lowest
MSExchange Availability\Availability Service                             Lowest
MSExchange Availability\Availability Service General                     Lowest
MSExchange Availability\Availability Service Authentication              Lowest
MSExchange Availability\Availability Service Authorization               Lowest
MSExchange Cluster\Move                                                  Lowest
MSExchange Cluster\Upgrade                                               Lowest
MSExchange Cluster\Action                                                Lowest
MSExchange Common\General                                                Lowest
MSExchange Common\Configuration                                          Lowest
MSExchange Common\Logging                                                Lowest
MSExchange RBAC\General                                                  Lowest
MSExchange RBAC\RBAC                                                     Low
MSExchange CmdletLogs\General                                            Lowest
MSExchange Configuration Cmdlet - Management Console\General             Lowest
MSExchange Configuration Cmdlet - Management Console\RBAC                Lowest
MSExchange Delegated Authentication Module\General                       Lowest
MSExchange LiveId Redirection Module\General                             Lowest
MSExchange Organization Redirection Module\General                       Lowest
MSExchange Certificate Authentication Module\General                     Lowest
MSExchange Control Panel\General                                         Lowest
MSExchange Control Panel\Performance                                     Lowest
MSExchange Control Panel\Redirect                                        Lowest
MSExchange Control Panel\Proxy                                           Lowest
MSExchange Extensibility\Transport Address Book                          Lowest
MSExchange Extensibility\MExRuntime                                      Lowest
MSExchange EdgeSync\Synchronization                                      Lowest
MSExchange EdgeSync\Topology                                             Lowest
MSExchange EdgeSync\SyncNow                                              Lowest
MSExchange TransportService\TransportService                             Lowest
MSExchange Web Services\Core                                             Lowest
MSExchange IMAP4\General                                                 Lowest
MSExchange IMAP4 BE\General                                              Lowest
MSExchange Messaging Policies\Journaling                                 Lowest
MSExchange Messaging Policies\AttachFilter                               Lowest
MSExchange Messaging Policies\AddressRewrite                             Lowest
MSExchange Messaging Policies\Rules                                      Lowest
MSExchange Messaging Policies\Prelicensing                               Lowest
MSExchange Messaging Policies\PolicyApplication                          Lowest
MSExchange Messaging Policies\JournalReportDecryption                    Lowest
MSExchange Messaging Policies\RightsManagement                           Lowest
MSExchange Messaging Policies\TransportDecryption                        Lowest
MSExchange Messaging Policies\RedirectionAgent                           Lowest
MSExchange Messaging Policies\Information Rights Management              Lowest
MSExchange Anti-spam Update\HygieneUpdate                                Lowest
MSExchange Mailbox Replication\Service                                   Lowest
MSExchange Mailbox Replication\Mailbox Move                              Lowest
MSExchange Mid-Tier Storage\Xtc                                          Lowest
MSExchange Mid-Tier Storage\Audit                                        Lowest
MSExchange Mid-Tier Storage\Discovery                                    Lowest
MSExchange Mid-Tier Storage\Information Rights Management                Lowest
MSExchange Mid-Tier Storage\CopyOnWrite                                  Lowest
MSExchange Mid-Tier Storage\ResourceHealth                               Lowest
MSExchange Management Application\Shell                                  Lowest
MSExchange Management Application\Console                                Lowest
MSExchange Management Application\ProvisioningAgent                      Lowest
MSExchange Management Application\ComponentInfoBasedTask                 Lowest
MSExchange Management Application\AdminAuditLog                          Lowest
MSExchange OWA\FormsRegistry                                             Lowest
MSExchange OWA\Core                                                      Lowest
MSExchange OWA\Configuration                                             Lowest
MSExchange OWA\Themes                                                    Lowest
MSExchange OWA\SmallIcons                                                Lowest
MSExchange OWA\Proxy                                                     Lowest
MSExchange OWA\Transcoding                                               Lowest
MSExchange OWA\ADNotifications                                           Lowest
MSExchange OWA\InstantMessage                                            Lowest
MSExchange POP3\General                                                  Lowest
MSExchange POP3 BE\General                                               Lowest
MSExchange Process Manager\ProcessManager                                Lowest
MSExchange Repl\Service                                                  Lowest
MSExchange Repl\Exchange VSS Writer                                      Lowest
MSExchange ReportingWebService\General                                   Lowest
MSExchange Topology\Topology Discovery                                   Lowest
MSExchange Unified Messaging\UMWorkerProcess                             Lowest
MSExchange Unified Messaging\UMCore                                      Lowest
MSExchange Unified Messaging\UMManagement                                Lowest
MSExchange Unified Messaging\UMService                                   Lowest
MSExchange Unified Messaging\UMClientAccess                              Lowest
MSExchange Unified Messaging\UMCallData                                  Lowest
MSExchange Unified Messaging\MWI General                                 Lowest
MSExchange Unified Messaging\UMCallRouter                                Lowest
MSExchange ADAccess\General                                              Lowest
MSExchange ADAccess\Cache                                                Lowest
MSExchange ADAccess\Topology                                              Low
MSExchange ADAccess\Configuration                                        Lowest
MSExchange ADAccess\LDAP                                                 Lowest
MSExchange ADAccess\Validation                                            Low
MSExchange ADAccess\Recipient Update Service                             Lowest
MSExchange ADAccess\Site Update                                          Lowest
MSExchange ADAccess\Exchange Topology                                    Lowest
MSExchange ADAccess\MSERV                                                Lowest
MSExchange ADAccess\GLS                                                  Lowest
MSExchangeADTopology\General                                             Lowest
MSExchangeADTopology\Configuration                                       Lowest
MSExchangeADTopology\Topology                                            Low
MSExchangeApplicationLogic\TextMessaging                                 Lowest
MSExchangeApplicationLogic\ServerPicker                                  Lowest
MSExchangeIS\General                                                     Lowest
MSExchangeIS\Physical Access                                             Lowest
MSExchangeIS\Logical Data Model                                          Lowest
MSExchangeIS\Directory Services                                          Lowest
MSExchangeIS\MAPI                                                        Lowest
MSExchangeIS\High Availability                                           Lowest
MSExchangeMailboxAssistants\Service                                      Lowest
MSExchangeMailboxAssistants\OOF Assistant                                Lowest
MSExchangeMailboxAssistants\OOF Library                                  Lowest
MSExchangeMailboxAssistants\Resource Booking Attendant                   Lowest
MSExchangeMailboxAssistants\Email_Lifecycle_Assistant                    Lowest
MSExchangeMailboxAssistants\Junk Email Options Assistant                 Lowest
MSExchangeMailboxAssistants\Conversations Assistant                      Lowest
MSExchangeMailboxAssistants\Approval Assistant                           Lowest
MSExchangeMailboxAssistants\ELC Library                                  Lowest
MSExchangeTransport\SmtpReceive                                          Lowest
MSExchangeTransport\SmtpSend                                             Lowest
MSExchangeTransport\DSN                                                  Lowest
MSExchangeTransport\Routing                                              Lowest
MSExchangeTransport\Logging                                              Lowest
MSExchangeTransport\Components                                           Lowest
MSExchangeTransport\RemoteDelivery                                       Lowest
MSExchangeTransport\Pickup                                               Lowest
MSExchangeTransport\Categorizer                                          Lowest
MSExchangeTransport\PoisonMessage                                        Lowest
MSExchangeTransport\MessageSecurity                                      Lowest
MSExchangeTransport\TransportService                                     Lowest
MSExchangeTransport\Exch50                                               Lowest
MSExchangeTransport\Process                                              Lowest
MSExchangeTransport\ResourceManager                                      Lowest
MSExchangeTransport\Configuration                                        Lowest
MSExchangeTransport\Storage                                              Lowest
MSExchangeTransport\Agents                                               Lowest
MSExchangeTransport\Transport Address Book                               Lowest
MSExchangeTransport\Orar                                                 Lowest
MSExchangeTransport\Unused                                               Lowest
MSExchangeTransport\ShadowRedundancy                                     Lowest
MSExchangeTransport\Approval                                             Lowest
MSExchangeTransport\TransportSafetyNet                                   Lowest
MSExchangeTransport\TransportTenantAttribution                           Lowest
MSExchangeTransportSyncCommon\General                                    Lowest
MSExchangeTransportSyncManager\General                                   Lowest
MSExchangeTransportSyncWorker\General                                    Lowest
MSExchangeTransportSyncWorkerFramework\General                           Lowest
MSExchange OutlookProtectionRules\Outlook Protection Rules               Lowest
MSExchange Provisioning MailboxAssistant\Provisioning Assistant General  Lowest
MSExchangeThrottling\General                                             Lowest
MSExchangeThrottlingClient\General                                       Lowest
MSExchange FailFast Module\General                                       Lowest
MSExchange Store Driver Delivery\MSExchangeStoreDriverDelivery           Lowest
MSExchange Store Driver Delivery\MeetingMessageProcessing                Lowest
MSExchange Store Driver Delivery\OofHistory                              Lowest
MSExchange Store Driver Delivery\Approval                                Lowest
MSExchange Store Driver Delivery\UnifiedMessaging                        Lowest
MSExchange Store Driver Submission\MSExchangeStoreDriverSubmission       Lowest
MSExchangeSubmission\MSExchangeSubmission                                Lowest
MSExchange Antimalware\General                                           Lowest
MSExchange Antimalware\Init                                              Lowest
MSExchange Antimalware\ScanResults                                       Lowest
MSExchange Antimalware\ScanError                                         Lowest
MSExchange OAuth\Requests                                                Lowest
MSExchange OAuth\Configuration                                           Low
MSExchange OAuth\Server                                                  2
MSExchange BackEndRehydration\Requests                                   Lowest
MSExchange BackEndRehydration\Configuration                              Low
MSExchange BackEndRehydration\Server                                     2
MSExchange Front End HTTP Proxy\Core                                     Lowest
MSExchange RemotePowerShell BackendCmdletProxy Module\General            Lowest
MSExchange Error Logging Module\General                                  Lowest
MSExchange Client Diagnostics Module\General                             Lowest
MSExchangeFrontEndTransport\SmtpReceive                                  Lowest
MSExchangeFrontEndTransport\SmtpSend                                     Lowest
MSExchangeFrontEndTransport\DSN                                          Lowest
MSExchangeFrontEndTransport\Routing                                      Lowest
MSExchangeFrontEndTransport\Logging                                      Lowest
MSExchangeFrontEndTransport\Components                                   Lowest
MSExchangeFrontEndTransport\RemoteDelivery                               Lowest
MSExchangeFrontEndTransport\Pickup                                       Lowest
MSExchangeFrontEndTransport\Categorizer                                  Lowest
MSExchangeFrontEndTransport\PoisonMessage                                Lowest
MSExchangeFrontEndTransport\MessageSecurity                              Lowest
MSExchangeFrontEndTransport\TransportService                             Lowest
MSExchangeFrontEndTransport\Exch50                                       Lowest
MSExchangeFrontEndTransport\Process                                      Lowest
MSExchangeFrontEndTransport\ResourceManager                              Lowest
MSExchangeFrontEndTransport\Configuration                                Lowest
MSExchangeFrontEndTransport\Storage                                      Lowest
MSExchangeFrontEndTransport\Agents                                       Lowest
MSExchangeFrontEndTransport\Transport Address Book                       Lowest
MSExchangeFrontEndTransport\Orar                                         Lowest
MSExchangeFrontEndTransport\Unused                                       Lowest
MSExchangeFrontEndTransport\ShadowRedundancy                             Lowest
MSExchangeFrontEndTransport\Approval                                     Lowest
MSExchangeFrontEndTransport\TransportSafetyNet                           Lowest
MSExchangeFrontEndTransport\TransportTenantAttribution                   Lowest

Interessant ist dabei, dass zwei Einstellungen "nicht Standard" sind und über die PowerShell so gar nicht mehr zu setzen sind. Auf http://technet.microsoft.com/en-us/library/dd335139(v=exchg.141).aspx steht der numerische Wert, der dem Level entspricht:

Technisch wird der Level in der Registrierung hinterlegt.

Hinweis
Ich habe bei Exchange 2013 versucht die numerischen Einstellungen direkt in der Registrierung zu ändern. Diese neuen Werte wurden aber bei Set-EventlogLevel nicht angezeigt.

Insofern kann man die "Standards" nur bedingt zurück stellen. Wer damit leben kann, dass die beiden Einstellungen mit dem Level "2" dann auf "Low" zurückgedreht sind, kann mit folgenden Skript die Werte wieder zurück stellen.

# Exchange 2013 Eventlog auf Standard stellen

# erst einmal alles auf  Lowest
get-eventloglevel | set-eventloglevel -level       Lowest
 
# dann die Ausnahmen, die auf LOW stehen
set-eventloglevel "MSExchange RBAC\RBAC" -level low
set-eventloglevel "MSExchange ADAccess\Topology" -level low
set-eventloglevel "MSExchange ADAccess\Validation" -level low
set-eventloglevel "MSExchangeADTopology\Topology" -level low
set-eventloglevel "MSExchange OAuth\Configuration" -level low
set-eventloglevel "MSExchange BackEndRehydration\Configuration" -level low
 
# und diese Ausnahmen kann man per PowerShell nicht setzen. Der Wert "2" ist etwas über low
set-eventloglevel "MSExchange OAuth\Server" -level low
set-eventloglevel "MSExchange BackEndRehydration\Server" -level low

Regedit

Die Einstellungen landen in der Registrierung unter "Diagnostics" beim entsprechenden Dienst und können dort natürlich auch direkt ausgelesen und geändert werden, z.B.

Auf einem Exchange 2016 Server habe ich folgende Einstellungen gefunden:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ExchangeStoreDb\Diagnostics]
"1 Database recovery"=dword:00000000
"2 ESE"=dword:00000000
"3 Store"=dword:00000000
"4 Content index"=dword:00000000
"5 Replay"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MailboxAssistants\Diagnostics]
"1 Service"=dword:00000000
"2 OOF Assistant"=dword:00000000
"3 OOF Library"=dword:00000000
"8 Resource Booking Attendant"=dword:00000000
"10 Email_Lifecycle_Assistant"=dword:00000000
"11 Junk Email Options Assistant"=dword:00000000
"12 Conversations Assistant"=dword:00000000
"13 Approval Assistant"=dword:00000000
"16 ELC Library"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange ActiveSync\Diagnostics]
"1 Requests"=dword:00000000
"2 Configuration"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange ADAccess\Diagnostics]
"1 General"=dword:00000000
"2 Cache"=dword:00000000
"3 Topology"=dword:00000001
"4 Configuration"=dword:00000000
"5 LDAP"=dword:00000000
"6 Validation"=dword:00000001
"7 Recipient Update Service"=dword:00000000
"8 Site Update"=dword:00000000
"9 Exchange Topology"=dword:00000000
"10 MSERV"=dword:00000000
"11 GLS"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange Anti-spam Update\Diagnostics]
"1 HygieneUpdate"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange Antimalware\Diagnostics]
"1 General"=dword:00000000
"2 Init"=dword:00000000
"3 ScanResults"=dword:00000000
"4 ScanError"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange Antispam\Diagnostics]
"1 General"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange Assistants\Diagnostics]
"1 Assistants"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange Autodiscover\Diagnostics]
"1 Core"=dword:00000000
"2 Web"=dword:00000000
"3 Provider"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange Availability\Diagnostics]
"4 Availability Service"=dword:00000000
"5 Availability Service General"=dword:00000000
"6 Availability Service Authentication"=dword:00000000
"7 Availability Service Authorization"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange Client Diagnostics Module\Diagnostics]
"1 General"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange Cluster\Diagnostics]
"3 Move"=dword:00000000
"4 Upgrade"=dword:00000000
"5 Action"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange CmdletLogs\Diagnostics]
"1 General"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange Common\Diagnostics]
"1 General"=dword:00000000
"2 Configuration"=dword:00000000
"3 Logging"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange Configuration Cmdlet - Management Console\Diagnostics]
"1 General"=dword:00000000
"2 RBAC"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange Configuration Core\Diagnostics]
"1 General"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange Control Panel\Diagnostics]
"1 General"=dword:00000000
"2 Performance"=dword:00000000
"3 Redirect"=dword:00000000
"4 Proxy"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange Delegated Authentication Module\Diagnostics]
"1 General"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange EdgeSync\Diagnostics]
"1 Synchronization"=dword:00000000
"2 Topology"=dword:00000000
"3 SyncNow"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange Error Logging Module\Diagnostics]
"1 General"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange Extensibility\Diagnostics]
"1 Transport Address Book"=dword:00000000
"2 MExRuntime"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange FailFast Module\Diagnostics]
"1 General"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange Front End HTTP Proxy\Diagnostics]
"1 Core"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange IMAP4\Diagnostics]
"1 General"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange IMAP4 BE\Diagnostics]
"1 General"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange LiveId Redirection Module\Diagnostics]
"1 General"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange Mailbox Replication\Diagnostics]
"1 Service"=dword:00000000
"2 Mailbox Move"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange Management Application\Diagnostics]
"1 Shell"=dword:00000000
"2 Console"=dword:00000000
"3 ProvisioningAgent"=dword:00000000
"4 ComponentInfoBasedTask"=dword:00000000
"5 AdminAuditLog"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange Messaging Policies\Diagnostics]
"1 Journaling"=dword:00000000
"2 AttachFilter"=dword:00000000
"3 AddressRewrite"=dword:00000000
"4 Rules"=dword:00000000
"5 Prelicensing"=dword:00000000
"6 PolicyApplication"=dword:00000000
"7 JournalReportDecryption"=dword:00000000
"8 RightsManagement"=dword:00000000
"9 TransportDecryption"=dword:00000000
"10 RedirectionAgent"=dword:00000000
"11 Information Rights Management"=dword:00000000
"12 Unified Policy Management"=dword:00000000
"13 DlpPolicyAgent"=dword:00000000
"14 RetentionPolicyAgent"=dword:00000000
"15 SupervisoryReviewAgent"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange Mid-Tier Storage\Diagnostics]
"1 Xtc"=dword:00000000
"2 Audit"=dword:00000000
"3 Discovery"=dword:00000000
"4 Information Rights Management"=dword:00000000
"5 CopyOnWrite"=dword:00000000
"6 ResourceHealth"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange Migration Workflow\Diagnostics]
"1 Service"=dword:00000000
"2 Migration Workflows"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange OAuth\Diagnostics]
"1 Requests"=dword:00000000
"2 Configuration"=dword:00000001
"3 Server"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange Organization Redirection Module\Diagnostics]
"1 General"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange OutlookProtectionRules\Diagnostics]
"19 Outlook Protection Rules"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange OWA\Diagnostics]
"1 FormsRegistry"=dword:00000000
"2 Core"=dword:00000000
"3 Configuration"=dword:00000000
"4 Themes"=dword:00000000
"5 SmallIcons"=dword:00000000
"6 Proxy"=dword:00000000
"7 Transcoding"=dword:00000000
"8 ADNotifications"=dword:00000000
"9 InstantMessage"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange POP3\Diagnostics]
"1 General"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange POP3 BE\Diagnostics]
"1 General"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange Process Manager\Diagnostics]
"1 ProcessManager"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange Provisioning MailboxAssistant\Diagnostics]
"20 Provisioning Assistant General"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange RBAC\Diagnostics]
"1 General"=dword:00000000
"2 RBAC"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange RemotePowershell BackendCmdletProxy Module\Diagnostics]
"1 General"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange Repl\Diagnostics]
"1 Service"=dword:00000000
"2 Exchange VSS Writer"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange ReportingWebService\Diagnostics]
"1 General"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange Store Driver Delivery\Diagnostics]
"1 MSExchangeStoreDriverDelivery"=dword:00000000
"2 MeetingMessageProcessing"=dword:00000000
"3 OofHistory"=dword:00000000
"4 Approval"=dword:00000000
"5 UnifiedMessaging"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange Store Driver Submission\Diagnostics]
"1 MSExchangeStoreDriverSubmission"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange Topology\Diagnostics]
"1 Topology Discovery"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange TransportService\Diagnostics]
"12 TransportService"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange Unified Messaging\Diagnostics]
"1 UMWorkerProcess"=dword:00000000
"2 UMCore"=dword:00000000
"3 UMManagement"=dword:00000000
"4 UMService"=dword:00000000
"5 UMClientAccess"=dword:00000000
"6 UMCallData"=dword:00000000
"7 MWI General"=dword:00000000
"8 UMCallRouter"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchange Web Services\Diagnostics]
"1 Core"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeADTopology\Diagnostics]
"1 General"=dword:00000000
"2 Configuration"=dword:00000000
"3 Topology"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeApplicationLogic\Diagnostics]
"1 TextMessaging"=dword:00000000
"2 ServerPicker"=dword:00000000
"3 Extension"=dword:00000000
"4 E4E"=dword:00000000
"5 DiagnosticHandlers"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeFrontEndTransport\Diagnostics]
"1 SmtpReceive"=dword:00000000
"2 SmtpSend"=dword:00000000
"3 DSN"=dword:00000000
"4 Routing"=dword:00000000
"5 Logging"=dword:00000000
"6 Components"=dword:00000000
"7 RemoteDelivery"=dword:00000000
"8 Pickup"=dword:00000000
"9 Categorizer"=dword:00000000
"10 PoisonMessage"=dword:00000000
"11 MessageSecurity"=dword:00000000
"12 TransportService"=dword:00000000
"13 Exch50"=dword:00000000
"14 Process"=dword:00000000
"15 ResourceManager"=dword:00000000
"16 Configuration"=dword:00000000
"17 Storage"=dword:00000000
"18 Agents"=dword:00000000
"19 Transport Address Book"=dword:00000000
"20 Orar"=dword:00000000
"21 Unused"=dword:00000000
"22 ShadowRedundancy"=dword:00000000
"23 Approval"=dword:00000000
"24 TransportSafetyNet"=dword:00000000
"25 TransportTenantAttribution"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\Diagnostics]
"1 General"=dword:00000000
"2 Physical Access"=dword:00000000
"3 Lazy Indexing"=dword:00000000
"4 Logical Data Model"=dword:00000000
"5 Directory Services"=dword:00000000
"6 MAPI"=dword:00000000
"7 High Availability"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeMailboxAssistants\Diagnostics]
"1 Service"=dword:00000000
"2 Discovery"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeSubmission\Diagnostics]
"1 MSExchangeSubmission"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeThrottling\Diagnostics]
"1 General"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeThrottlingClient\Diagnostics]
"1 General"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeTransport\Diagnostics]
"1 SmtpReceive"=dword:00000000
"2 SmtpSend"=dword:00000000
"3 DSN"=dword:00000000
"4 Routing"=dword:00000000
"5 Logging"=dword:00000000
"6 Components"=dword:00000000
"7 RemoteDelivery"=dword:00000000
"8 Pickup"=dword:00000000
"9 Categorizer"=dword:00000000
"10 PoisonMessage"=dword:00000000
"11 MessageSecurity"=dword:00000000
"12 TransportService"=dword:00000000
"13 Exch50"=dword:00000000
"14 Process"=dword:00000000
"15 ResourceManager"=dword:00000000
"16 Configuration"=dword:00000000
"17 Storage"=dword:00000000
"18 Agents"=dword:00000000
"19 Transport Address Book"=dword:00000000
"20 Orar"=dword:00000000
"21 Unused"=dword:00000000
"22 ShadowRedundancy"=dword:00000000
"23 Approval"=dword:00000000
"24 TransportSafetyNet"=dword:00000000
"25 TransportTenantAttribution"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeTransportSyncCommon\Diagnostics]
"1 General"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeTransportSyncManager\Diagnostics]
"1 General"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeTransportSyncWorker\Diagnostics]
"1 General"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeTransportSyncWorkerFramework\Diagnostics]
"1 General"=dword:00000000

Weitere Links

• Diagnoseprotokoll Ex 200x
• Manage Diagnostic Logging Levels
  http://technet.microsoft.com/en-us/library/dd335139(v=exchg.141).aspx