Why Change Auditor for Exchange Enables the Exchange Scripting Agent on an Exchange Server

To understand why Change Auditor for Exchange requires the Exchange Scripting Agent, it is important to understand the function of the Exchange Scripting Agent.

The Scripting Agent is called (if enabled) when a cmdlet runs on an Exchange server. This includes not only cmdlets run directly in the Exchange Management Shell, but also cmdlets run by Exchange services, the Exchange Management Console (EMC) and the Exchange Control Panel (ECP).

The Scripting Agent analyzes the ScriptingAgentConfig.xml file for additional script functions that extend the capabilities of the cmdlet being executed. If a script should be run, the cmdlet tries to call any APIs defined in the script.

The default ScriptingAgentConfig.xml files (shown below) contain some script functions that affect cmdlets for creating new mailbox as well as creating and modifying distribution groups.

Scripting Agent Change Auditor for Exchange

The Change Auditor agent installed on the Exchange server will enable the Exchange Scripting Agent in the Active Directory Forest on first startup — this requires renaming the “ScriptingAgentConfig.xml.sample” (if it exists) to ScriptingAgentConfig.xml, and a new file will be created if one does not already exist.

The Change Auditor agent adds a custom script function called “Dell-ChangeAuditor- CmdletHandler” to the ScriptingAgentConfig.xml file (shown below). This includes API function calls for capturing Exchange change event data when the cmdlets defined in the function are validated or when they complete their tasks.

Change Auditor for Exchange

We recommend understanding and testing the default script functions in the configuration .xml file (shown below) and deploying a Change Auditor agent to all Exchange servers to ensure the “ScriptingAgentConfig.xml” has been created on each. This helps to avoid issues executing cmdlets on Exchange servers where the file does not exist.

If the Exchange Scripting Agent is not enabled, Exchange event data resulting from executing Exchange cmdlets in the Exchange Management Shell, by Exchange services, in Exchange Management Console or the Exchange Control Panel will not be recorded.

For more information, Learn about understanding the scripting agent