Search the Mailbox Audit Log for a Mailbox
Applies to: Exchange Server 2010 SP3, Exchange Server 2010 SP2
You can synchronously search mailbox audit log entries for a mailbox and have the search results displayed in the Shell.
Note
By default, mailbox audit logging is disabled for all mailboxes. For each mailbox you want to audit, you must enable audit logging and specify the mailbox owner, delegate, or administrator actions you want to audit. For more details, see Enable or Disable Mailbox Audit Logging for a Mailbox.
If you want to search mailbox audit logs for multiple mailboxes and have the results sent by e-mail to a specified address, you must create a mailbox audit log search instead. For more information, see Create a Mailbox Audit Log Search.
Looking for other management tasks related to mailbox audit logging? Check out Managing Mailbox Audit Logging.
Use the Shell to search the mailbox audit log for a mailbox
You need to be assigned permissions before you can perform this procedure. To see what permissions you need, see the "Mailbox audit logging" entry in the Messaging Policy and Compliance Permissions topic.
Note
You can't use the EMC to search the mailbox audit log for a mailbox.
This example retrieves mailbox audit log entries for Ken Kwok's mailbox for actions performed by administrators and user delegates between 1/1/2010 and 12/31/2010. A maximum of 2,000 log entries are returned.
Search-MailboxAuditLog -Identity kwok -LogonTypes Admin,Delegate -StartDate 1/1/2010 -EndDate 12/31/2010 -ResultSize 2000
For detailed syntax and parameter information, see Search-MailboxAuditLog.
Other Tasks
After you search the mailbox audit log for a mailbox, you may also want to enable or disable mailbox audit logging. For detailed steps, see Enable or Disable Mailbox Audit Logging for a Mailbox.
© 2010 Microsoft Corporation. All rights reserved.