Under Export Mailbox Audit logs window, provide the details and click on Export: Open EAC à Compliance Management à Auditing à Click on Export Mailbox Audit logs: Use auditing reports in the Exchange admin center (EAC): using Auditing tab under Exchange Admin Center we can run a non-owner mailbox access report (contains entries for admin and delete actions) or export mailbox audit log as below: We can use the below methods to search mailbox audit log entries:Īsynchronously search one or more mailboxes: Using New-MailboxAuditLogSearch cmdlet we can create a mailbox audit log search to asynchronously search mailbox audit logs for one or more mailboxes, and results will be sent to specified email addres as an XML attachment.Ĭmdlet: New-MailboxAuditLogSearch 'Admin and Delegate Access' -Mailboxes '','User2' -LogonTypes Admin,Delegate -StartDate -EndDate -StatusMailRecipients Get-Mailbox -ResultSize Unlimited -Filter | Set-Mailbox -AuditEnabled $true

Use the below cmdlet to enable audit logging for all mailboxes in the organization: Get-Mailbox |fl name,AuditEnabled,AudiLogAgeLimit NOTE: Mailbox movement also moves the mailbox audit logs for that mailbox as these logs are located in the mailbox. Once the mailbox audit logging enabled on the mailbox, the mailbox audit logs will generate and store in Recoverable Items folder in the audited mailbox in the Audits subfolder, irrespective of which client access method was used to access the mailbox or which server or computer an administrator uses to access the mailbox audit log. Mailbox audit logging records IP address, host name, and process or client used to access the mailbox. Mailbox audit logging feature helps to trace the logs of mailbox access by owner, Delegates and Administrator. As the mailboxes contain sensitive, high business impact (HBI) information and personally identifiable information (PII) it is essential to keep a track on who logs in to the mailboxes and what actions are taken, especially to have a track of access to mailboxes by Delegated user access (other than mailbox owners).

Change outlook identity 2016