Forum Discussion

Jason Gaffney's avatar
Jason Gaffney
Copper Contributor
Mar 28, 2018

Shared Mailbox audit

Hello,

I am having trouble auditing a shared mailbox.  I have enabled auditing on a shared mailbox. When viewing the audit logs via the Compliance Manager the only audited event I have are from a user working in OWA. I do not see any events logged from any users using outlook.

 

 

Here is the status of the mailbox

 

PS C:\WINDOWS\system32> Get-Mailbox MAILBOXNAME | fl au*


AutoExpandingArchiveEnabled : False
AuditEnabled                : True
AuditLogAgeLimit            : 60.00:00:00
AuditAdmin                  : {Update, Move, MoveToDeletedItems, SoftDelete...}
AuditDelegate               : {Update, Move, MoveToDeletedItems, SoftDelete...}
AuditOwner                  : {Update, Move, MoveToDeletedItems, SoftDelete...}
  • Have you checked the actual mailbox audit logs, the ones stored in the mailbox not the SCC console? In other words, run this:

     

    Search-MailboxAuditLog -Identity shared -ShowDetails -LogonTypes Delegate

    • Robert Luck's avatar
      Robert Luck
      Iron Contributor

      Thanks for sharing. I thought all the audit logs are available in SCC!.

      • VasilMichev's avatar
        VasilMichev
        MVP

        In theory, yes. In practice... not as reliable as you might think. Did you find the events in the mailbox log?

Resources