Forum Discussion
Filter by Shared Mailbox, not user.
Hi All, We had an instance in a Shared Mailbox where somebody (unknown) deleted a large amount of emails. I'm trying to find a way to identify who the user was. So far I can filter down to: A...
Mailbox auditing is not enabled by default for shared mailboxes, so you might simply not have any of those events. In any case, instead of using the CAS UI, run the Search-MailboxAuditLog cmdlet: https://docs.microsoft.com/en-us/powershell/module/exchange/policy-and-compliance-audit/search-mailboxauditlog?view=exchange-ps