How To Enable Mailbox Auditing On Exchange 2010 /2013

Mailbox Audit logging allows tracking of many actions inside the mailbox like, copy, move, softdelete, harddelete, etc.

Mailbox logging is not enabled by default and once enabled the logs are kept inside the mailbox and are there for 90 days.

To Enable Mailbox audit Logging open Exchange EMS and type:

Set-Mailbox NAME -AuditEnabled $true


To enable auditing on all mailbox type


Get-mailbox –resultsize unlimited | -AuditEnabled $true


To view the audit entries use the ECP by going to

Role & Auditing -> Run a Non-owner mailbox access report

You can also use powershell by using the Search-MailboxAuditLog

To email the report use the cmdlet below:

New-MailboxAuditLogSearch –StartDate “1/12/2014” –EndDate “4/12/2014” –Mailboxes NAME –LogonTypes owner –StatusMailRecipients SENDREPORTTO@EMAIL.LOCAL -ShowDetails