Mailbox Audit logging allows tracking of many actions inside the mailbox like, copy, move, softdelete, harddelete, etc.
Mailbox logging is not enabled by default and once enabled the logs are kept inside the mailbox and are there for 90 days.
To Enable Mailbox audit Logging open Exchange EMS and type:
Set-Mailbox NAME -AuditEnabled $true
To enable auditing on all mailbox type
Get-mailbox –resultsize unlimited | -AuditEnabled $true
To view the audit entries use the ECP by going to
Role & Auditing -> Run a Non-owner mailbox access report
You can also use powershell by using the Search-MailboxAuditLog
To email the report use the cmdlet below:
New-MailboxAuditLogSearch –StartDate “1/12/2014” –EndDate “4/12/2014” –Mailboxes NAME –LogonTypes owner –StatusMailRecipients SENDREPORTTO@EMAIL.LOCAL -ShowDetails