How To Enable Mailbox Auditing On Exchange 2010 /2013

Mailbox Audit logging allows tracking of many actions inside the mailbox like, copy, move, softdelete, harddelete, etc.

Mailbox logging is not enabled by default and once enabled the logs are kept inside the mailbox and are there for 90 days.

To Enable Mailbox audit Logging open Exchange EMS and type:

Set-Mailbox NAME -AuditEnabled $true

 

To enable auditing on all mailbox type

 

Get-mailbox –resultsize unlimited | -AuditEnabled $true

 

To view the audit entries use the ECP by going to

Role & Auditing -> Run a Non-owner mailbox access report

You can also use powershell by using the Search-MailboxAuditLog

To email the report use the cmdlet below:

New-MailboxAuditLogSearch –StartDate “1/12/2014” –EndDate “4/12/2014” –Mailboxes NAME –LogonTypes owner –StatusMailRecipients [email protected] -ShowDetails