SOLVED

Search-MailboxAuditLog export email operations

%3CLINGO-SUB%20id%3D%22lingo-sub-196450%22%20slang%3D%22en-US%22%3ESearch-MailboxAuditLog%20export%20email%20operations%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-196450%22%20slang%3D%22en-US%22%3EHello%2C%20is%20it%20possible%20to%20track%20through%20audit%20logs%20or%20other%2C%20the%20export%7Cdownload%20of%20a%20mailbox%20to%20pst%20or%20some%20format%20for%20offline%20reading%3F%3CBR%20%2F%3E%3CBR%20%2F%3EEg%20does%20turning%20on%20OWA%20offline%20mode%2C%20or%20export%20pst%20using%20Powershell%20trigger%20an%20audit%20event%3F%3CBR%20%2F%3E%3CBR%20%2F%3EI%20think%20Powershell%20is%20logged.%3CBR%20%2F%3E%3CBR%20%2F%3EI%20guess%20I%20could%20perform%20this%20on%20my%20own%20mailbox%20to%20test%2C%20but%20any%20solid%20advice%20or%20knowledge%20would%20help%20here.%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-196450%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EExchange%20Online%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-196637%22%20slang%3D%22en-US%22%3ERe%3A%20Search-MailboxAuditLog%20export%20email%20operations%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-196637%22%20slang%3D%22en-US%22%3E%3CP%3EExport%20via%20PST%20is%20an%20admin-level%20functionality%2C%20so%20it's%20audited%20by%20default.%20Using%20the%20offline%20mode%20in%20clients%20is%20not%20audited%20afaik.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Frequent Contributor
Hello, is it possible to track through audit logs or other, the export|download of a mailbox to pst or some format for offline reading?

Eg does turning on OWA offline mode, or export pst using Powershell trigger an audit event?

I think Powershell is logged.

I guess I could perform this on my own mailbox to test, but any solid advice or knowledge would help here.
1 Reply
Highlighted
Best Response confirmed by Andrew Huddleston (Frequent Contributor)
Solution

Export via PST is an admin-level functionality, so it's audited by default. Using the offline mode in clients is not audited afaik.