Forum Discussion
Jason Gaffney
Mar 28, 2018Copper Contributor
Shared Mailbox audit
Hello,
I am having trouble auditing a shared mailbox. I have enabled auditing on a shared mailbox. When viewing the audit logs via the Compliance Manager the only audited event I have are from a user working in OWA. I do not see any events logged from any users using outlook.
Here is the status of the mailbox
PS C:\WINDOWS\system32> Get-Mailbox MAILBOXNAME | fl au* AutoExpandingArchiveEnabled : False AuditEnabled : True AuditLogAgeLimit : 60.00:00:00 AuditAdmin : {Update, Move, MoveToDeletedItems, SoftDelete...} AuditDelegate : {Update, Move, MoveToDeletedItems, SoftDelete...} AuditOwner : {Update, Move, MoveToDeletedItems, SoftDelete...}
Have you checked the actual mailbox audit logs, the ones stored in the mailbox not the SCC console? In other words, run this:
Search-MailboxAuditLog -Identity shared -ShowDetails -LogonTypes Delegate
- Robert LuckIron Contributor
Thanks for sharing. I thought all the audit logs are available in SCC!.
In theory, yes. In practice... not as reliable as you might think. Did you find the events in the mailbox log?