Share via

Create a mailbox audit log search

  • Article

Applies to: Exchange Server 2013

You can create a mailbox audit log search to asynchronously search one or more mailboxes and have the search results sent by email as an XML file to specified addresses.

To search mailbox audit logs for a single mailbox and have the results displayed in the Shell, see Search the mailbox audit log for a mailbox.

For additional management tasks related to mailbox audit logging, see Mailbox audit logging procedures.

What do you need to know before you begin?

  • Estimated time to complete: 2 minutes.

  • You need to be assigned permissions before you can perform this procedure or procedures. To see what permissions you need, see the "Mailbox audit logging" entry in the Messaging policy and compliance permissions topic.

  • By default, mailbox audit logging is disabled for all mailboxes. For each mailbox you want to audit, you must enable audit logging and specify the mailbox owner, delegate, or administrator actions you want to audit. For more details, see Enable or disable mailbox audit logging for a mailbox.

  • You can't use the EAC to search mailbox audit logs for owner access. The auditing section in EAC includes reports for non-owner mailbox access and also allows you to search for and export non-owner access events.

  • For information about keyboard shortcuts that may apply to the procedures in this topic, see Keyboard shortcuts in the Exchange admin center.

Tip

Having problems? Ask for help in the Exchange forums. Visit the forums at Exchange Server.

  1. Navigate to Compliance management > Auditing.

  2. In the list view, select Export mailbox audit logs.

  3. In Export Mailbox Audit Logs, complete the following fields, and then click Export:

    • Start date

    • End date

    • Search these mailboxes or leave blank to find all mailboxes accessed by non-owners

      Warning

      Depending on the number of mailboxes in your organization and the amount of mailbox audit log data in each mailbox, searching all mailboxes may take a long time.

    • Search for access by

      Select from the following types of access events you want to search:

      • All non-owners

      • External users

      • Administrators and delegated users

      • Administrators

    • Send the auditing report to

For an example of how to use the Shell to create a mailbox audit log search, see Example 1 in New-MailboxAuditLogSearch.