Forum Discussion
Logging mailbox/calendar activity
I have a user that is complaining that her calendar keeps getting wiped of all appts. At first it was a shared calendar so I made it a secondary calendar for her only and made sure only she had permissions to it. A couple days later she claims that it was wiped again.
Is there a way to log calendar activity to see who may be deleting appointments?
I turned on audit logging in the Security and Compliance center but that only seems to log mailbox login activity.
I turned on Mailbox auditing per https://docs.microsoft.com/en-us/office365/securitycompliance/enable-mailbox-auditing but I still don't see anything in the audit logs as far as mailbox activity for her. I actually turned it on for all users but still get nothing logged as far as activity in the mailbox. I know they've active in her account. I'm pretty sure I got the mailbox auditing configured correctly. This is what powershell returns for the users:
AuditEnabled : True
AuditLogAgeLimit : 90.00:00:00
AuditAdmin : {Update, MoveToDeletedItems, SoftDelete, HardDelete...}
AuditDelegate : {Update, MoveToDeletedItems, SoftDelete, HardDelete...}
AuditOwner : {Update, MoveToDeletedItems, SoftDelete, HardDelete...}
I would start by disabling the account on any mobile devices, there have been numerous occasions where different mobile apps have caused various issues with calendars, including deleting items. In general, auditing should cover any deletions, but best check it directly (Search-MailboxAuditLog) as the audit log in the SCC is not very reliable. Just in case, you can also check the Calendar diagnostic logs: https://docs.microsoft.com/en-us/powershell/module/exchange/mailboxes/get-calendardiagnosticlog?view=exchange-ps
- Oh nice. I'll definitely check those out!
