Auditing an O365 shared mailbox

%3CLINGO-SUB%20id%3D%22lingo-sub-151936%22%20slang%3D%22en-US%22%3EAuditing%20an%20O365%20shared%20mailbox%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-151936%22%20slang%3D%22en-US%22%3E%3CP%3EI%20have%20turned%20on%20auditing%20on%20an%20Office%20365%20shared%20mailbox%2C%20but%20when%20I%20do%20a%20search%20at%20the%20audit%20logs%20I%20get%20zero%20results.%3C%2FP%3E%0A%3CP%3EI've%20expanded%20from%20the%20standard%20auditing%20and%20added%20the%20parameters%20%22harddelete%2C%20softdelete%2C%20movetodeleteditems%22%2C%20etc.%20I%20put%20those%20parameters%20under%20all%203%20catagories%3A%20auditadmin%2C%20auditdelegate%2C%20and%20auditowner.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWe%20had%20someone%20say%20an%20email%20disappeared%20again%20today%2C%20but%20I%20get%20no%20results%20when%20I%20searched%20the%20logs.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI%20even%20verified%20that%20auditing%20was%20turned%20on%20by%20doing%20a%20'get-mailbox'%20which%20shows%20it%20on.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAnything%20I%20am%20doing%20wrong%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-151936%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3Eauditing%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Eshared%20mailbox%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-221723%22%20slang%3D%22en-US%22%3ERe%3A%20Auditing%20an%20O365%20shared%20mailbox%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-221723%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSPAN%3EAuditing%20works%20for%20both%20type%20of%20customers%3A%20business%20as%20well%20as%20regular%20ones.%20Thus%2C%20the%20share%20mailboxes%20are%20also%20subject%20to%20the%20same%20audit%20mechanisms.%20Audit%20will%20not%20be%20enabled%20by%20default%20in%20any%20of%20the%20mailboxes%2C%20it%20needs%20to%20activated%20manually.%20%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EYou%20can%20try%20two%20options%3A%201.%20To%20view%20log%20entries%20w.r.t%20a%20specific%20action%2C%20performed%20by%20a%20user%20of%20a%20selected%20type%20(owner%2C%20delegate%20or%20administrator)%20in%20a%20given%20timespan%2C%20run%20the%20following%20PowerShell%20command%3A%20%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3ESearch-MailboxAuditLog%20%E2%80%93Identity%20%5Buser%20or%20shared%20mailbox%20name%5D%20%E2%80%93LogonTypes%20Owner%20%E2%80%93ShowDetails%20%E2%80%93StartDate%20%5Bstart%20date%3A%20d%2Fm%2Fy%5D%20%E2%80%93EndDate%20%5Bend%20date%3A%20d%2Fm%2Fy%5D%20%7C%20Where-Object%20%7B%24_.Operation%20-eq%20%E2%80%9C%5Baction%20name%5D%E2%80%9D%7D%20%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3E2.%26nbsp%3B%20You%20can%20also%20search%20the%20Exchange%20audit%20mailbox%20audit%20logs%20through%20Exchange%20Control%20Panel%20(ECP).%20Once%20you%20start%20ECP%2C%26nbsp%3Bgo%20to%20compliance%20management%20%26gt%3Bauditing.%20%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EYou%20can%20also%20generate%20the%20report%20for%20actions%20performed%20on%20one%20or%20more%20shared%20mailboxes%2C%20click%20%22Run%20a%20non-owner%20mailbox%20access%20report...%22%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-153241%22%20slang%3D%22en-US%22%3ERe%3A%20Auditing%20an%20O365%20shared%20mailbox%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-153241%22%20slang%3D%22en-US%22%3E%3CP%3EI%20have%20also%20tested%20this%20a%20little%20bit%20in%20a%20lab%20environment.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIf%20I%20drag%20and%20drop%20items%20from%20my%20normal%20mailbox%20to%20a%20shared%20mailbox%2C%20then%20I%20see%20'create'%20events%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3ERecordType%20%20%20%3A%20ExchangeItem%0ACreationDate%20%3A%202%2F6%2F2018%203%3A39%3A35%20PM%0AUserIds%20%20%20%20%20%20%3A%20rob.wilcox%40mydomain%0AOperations%20%20%20%3A%20Create%0AAuditData%20%20%20%20%3A%20%7B%22CreationTime%22%3A%222018-02-06T15%3A39%3A35%22%2C%22Id%22%3A%22f3f641a9-ee7d-4512-f346-08d56d77d337%22%2C%22Operation%22%3A%22Create%22%2C%22%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20OrganizationId%22%3A%223d8d2c25-3f01-44c4-8451-55c7edd3d196%22%2C%22RecordType%22%3A2%2C%22ResultStatus%22%3A%22Succeeded%22%2C%22UserKe%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20y%22%3A%2210030000A2078A02%22%2C%22UserType%22%3A0%2C%22Version%22%3A1%2C%22Workload%22%3A%22Exchange%22%2C%22UserId%22%3A%22rob.wilcox%40mydomain%22%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%2C%22ClientIPAddress%22%3A%2286.138.186.83%22%2C%22ClientInfoString%22%3A%22Client%3DMSExchangeRPC%22%2C%22ClientProcessName%22%3A%22OUTLOO%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20K.EXE%22%2C%22ClientVersion%22%3A%2215.0.4701.1000%22%2C%22ExternalAccess%22%3Afalse%2C%22InternalLogonType%22%3A0%2C%22LogonType%22%3A2%2C%22Logo%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20nUserSid%22%3A%22S-1-5-21-3875625135-3762442642-3260609188-6692264%22%2C%22MailboxGuid%22%3A%22ed664543-080a-4f46-9200-fa0%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%200f1f89e81%22%2C%22MailboxOwnerMasterAccountSid%22%3A%22S-1-5-10%22%2C%22MailboxOwnerSid%22%3A%22S-1-5-21-3875625135-3762442642-3%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20260609188-8243514%22%2C%22MailboxOwnerUPN%22%3A%22junk%40mydomain%22%2C%22OrganizationName%22%3A%22mydomain.onmicrosoft.com%22%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%2C%22OriginatingServer%22%3A%22LOXP123MB1224%20(15.20.0464.016)%5Cu000d%5Cu000a%22%2C%22Item%22%3A%7B%22Id%22%3A%22RgAAAAC4iGPlAX1lSIThCQIA%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20YsbCBwDAuVyFXM%5C%2FSQoeCukWN61U0AAAAAAEMAADAuVyFXM%5C%2FSQoeCukWN61U0AAB8KSDqAAAJ%22%2C%22ParentFolder%22%3A%7B%22Id%22%3A%22LgAAAA%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20C4iGPlAX1lSIThCQIAYsbCAQDAuVyFXM%5C%2FSQoeCukWN61U0AAAAAAEMAAAB%22%2C%22Path%22%3A%22%5C%5CInbox%22%7D%2C%22Subject%22%3A%22test3%22%7D%7D%0AResultIndex%20%20%3A%203%0AResultCount%20%20%3A%203%0AIdentity%20%20%20%20%20%3A%20f3f641a9-ee7d-4512-f346-08d56d77d337%0AIsValid%20%20%20%20%20%20%3A%20True%0AObjectState%20%20%3A%20Unchanged%3C%2FPRE%3E%0A%3CP%3EThe%20subject%20of%20the%20message%20was%20'test3'%20and%20the%20path%20was%20indeed%20'Inbox'%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EBut%20when%20I%20delete%20(soft%20or%20hard)%20I%20don't%20see%20those%2C%20I%20don't%20see%20them%20at%20all.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20query%20I%20used%20is%20this%20(though%20I%20also%20tried%20broader%20ones%20as%20well%20around%20this%20date%2Ftime)%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CPRE%3Esearch-unifiedauditlog%20-startdate%2002%2F06%2F2018%20-enddate%2002%2F07%2F2018%20-recordtype%20'exchangeitem'%20-userids%20'rob.wi%20lcox%40mydomain.com'%3C%2FPRE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-153238%22%20slang%3D%22en-US%22%3ERe%3A%20Auditing%20an%20O365%20shared%20mailbox%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-153238%22%20slang%3D%22en-US%22%3EHi%20Jacob%2C%3CBR%20%2F%3E%3CBR%20%2F%3EIt%20can%20take%20a%20while%20..%3CBR%20%2F%3E%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fsupport.office.com%2Fen-us%2Farticle%2FSearch-the-audit-log-in-the-Office-365-Security-Compliance-Center-0d4d0f35-390b-4518-800e-0c7ec95e946c%23PickTab%3DBYB%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fsupport.office.com%2Fen-us%2Farticle%2FSearch-the-audit-log-in-the-Office-365-Security-Compliance-Center-0d4d0f35-390b-4518-800e-0c7ec95e946c%23PickTab%3DBYB%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3EThanks%3CBR%20%2F%3ERob%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-152162%22%20slang%3D%22en-US%22%3ERe%3A%20Auditing%20an%20O365%20shared%20mailbox%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-152162%22%20slang%3D%22en-US%22%3E%3CP%3Efollowing%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F58%22%20target%3D%22_blank%22%3E%40Vasil%20Michev%3C%2FA%3E's%20reply%2C%20please%20perform%20a%20search%20using%20Search-MailboxAuditLog%20cmdlet%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fff522360(v%3Dexchg.160).aspx%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fff522360(v%3Dexchg.160).aspx%3C%2FA%3E%3C%2FP%3E%0A%3CP%3EAlso%2C%20you%20can%20try%20searching%20audit%20logs%20in%20Security%20and%20Compliance%20center%2C%20or%20by%20running%20Search-UnifiedAuditLog%20cmdlet%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fmt238501%2528v%3Dexchg.160%2529.aspx%3Ff%3D255%26amp%3BMSPPError%3D-2147217396%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fmt238501%2528v%3Dexchg.160%2529.aspx%3Ff%3D255%26amp%3BMSPPError%3D-2147217396%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-152140%22%20slang%3D%22en-US%22%3ERe%3A%20Auditing%20an%20O365%20shared%20mailbox%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-152140%22%20slang%3D%22en-US%22%3E%3CP%3ESorry%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F44872%22%20target%3D%22_blank%22%3E%40Jacob%20Airov%3C%2FA%3E%2C%20I%20mean%20the%20actual%20searching%20cmdlets.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-151968%22%20slang%3D%22en-US%22%3ERe%3A%20Auditing%20an%20O365%20shared%20mailbox%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-151968%22%20slang%3D%22en-US%22%3ESurely%20it%20will%20not%20take%20a%20day!%3CBR%20%2F%3E%3CBR%20%2F%3EI%20have%20seen%20a%20maximum%20of%20an%20hour%20delay%2C%20In%20some%20cases%2C%20I%20could%20see%20that%20the%20activities%20are%20tracked%20after%20few%20minutes.%3CBR%20%2F%3E%3CBR%20%2F%3EHow%20did%20you%20confirm%20that%20your%20settings%20didn't%20work%3F%20Did%20you%20try%20deleting%20any%20emails%20and%20checked%20the%20audit%20log%3F%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-151965%22%20slang%3D%22en-US%22%3ERe%3A%20Auditing%20an%20O365%20shared%20mailbox%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-151965%22%20slang%3D%22en-US%22%3E%3CP%3EDo%20you%20know%2C%20or%20is%20there%20documentation%20on%20how%20fast%20these%20turn%20on%3F%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI%20did%20these%20commands%20days%20ago%20and%20the%20incident%20that%20i%20wanted%20to%20catch%20in%20a%20log%20happened%20today.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-151963%22%20slang%3D%22en-US%22%3ERe%3A%20Auditing%20an%20O365%20shared%20mailbox%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-151963%22%20slang%3D%22en-US%22%3E%3CP%3EFrom%20my%20experience%2C%20The%20auditing%20configurations%20are%20not%20affected%20immediately.%20It%20will%20take%20some%20time%20to%20start%20monitoring%20the%20configured%20audit%20actions.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-151961%22%20slang%3D%22en-US%22%3ERe%3A%20Auditing%20an%20O365%20shared%20mailbox%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-151961%22%20slang%3D%22en-US%22%3E%3CP%3EI%20started%20with-%3C%2FP%3E%0A%3CPRE%3Eset-mailbox%20-identity%20%22name%22%20-auditenabled%20%24true%3C%2FPRE%3E%0A%3CP%3Ethen%20i%20specified%20actions%20with-%3C%2FP%3E%0A%3CPRE%3Eset-mailbox%20%22name%22%20-auditdelegate%20%40%7Badd%3D%22softdelete%22%2C%20%22harddelete%22%7D%3C%2FPRE%3E%0A%3CP%3EAfter%20i%20checked%20with-%3C%2FP%3E%0A%3CPRE%3Eget-mailbox%20%22name%22%20%7C%20FL%20Audit*%3C%2FPRE%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-151942%22%20slang%3D%22en-US%22%3ERe%3A%20Auditing%20an%20O365%20shared%20mailbox%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-151942%22%20slang%3D%22en-US%22%3E%3CP%3EIt%20depends%20on%20the%20action%20performed.%20What%20method%20are%20you%20using%20to%20check%20the%20logs%2C%20if%20PowerShell%2C%20share%20the%20exact%20cmdlets%20just%20to%20double-check.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1511625%22%20slang%3D%22en-US%22%3ERe%3A%20Auditing%20an%20O365%20shared%20mailbox%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1511625%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F44872%22%20target%3D%22_blank%22%3E%40Jacob%20Airov%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHi%20Jacob%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EPlease%20try%20to%20run%20the%20below%20PS%20script%20%2C%20for%20me%20is%20working%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESearch-MailboxAuditLog%20-Identity%20%22email%20address%20of%20mailbox%2FSM%E2%80%9D%20%26nbsp%3B-LogonTypes%20Admin%2CDelegate%2COwner%20-StartDate%20%3CSTRONG%3E11%2F17%2F2019%20-EndDate%2011%2F28%2F2019%20%3C%2FSTRONG%3E-ShowDetails%20%7C%20select-object%20Operation%2C%20OperationResult%2C%20LogonType%2C%20logonuserdisplayname%2C%20SourceItemSubjectsList%2C%20itemsubject%2C%20SourceItemFolderPathNamesList%2C%20LastAccessed%2C%20InternalLogonType%2C%20MailboxOwnerUPN%2C%20ClientIPAddress%2CClientProcessName%2CClientInfoString%2C%20ClientVersion%20%7C%20export-csv%20.%5CDesktop%5CAuditlog.csv%20-Encoding%20Unicode%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHope%20it%20helps.%3C%2FP%3E%3CP%3ECostin%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Occasional Contributor

I have turned on auditing on an Office 365 shared mailbox, but when I do a search at the audit logs I get zero results.

I've expanded from the standard auditing and added the parameters "harddelete, softdelete, movetodeleteditems", etc. I put those parameters under all 3 catagories: auditadmin, auditdelegate, and auditowner.

 

We had someone say an email disappeared again today, but I get no results when I searched the logs.

 

I even verified that auditing was turned on by doing a 'get-mailbox' which shows it on.

 

Anything I am doing wrong?

11 Replies
Highlighted

It depends on the action performed. What method are you using to check the logs, if PowerShell, share the exact cmdlets just to double-check.

Highlighted

I started with-

set-mailbox -identity "name" -auditenabled $true

then i specified actions with-

set-mailbox "name" -auditdelegate @{add="softdelete", "harddelete"}

After i checked with-

get-mailbox "name" | FL Audit*
Highlighted

From my experience, The auditing configurations are not affected immediately. It will take some time to start monitoring the configured audit actions.

Highlighted

Do you know, or is there documentation on how fast these turn on? 

 

I did these commands days ago and the incident that i wanted to catch in a log happened today.

Highlighted
Surely it will not take a day!

I have seen a maximum of an hour delay, In some cases, I could see that the activities are tracked after few minutes.

How did you confirm that your settings didn't work? Did you try deleting any emails and checked the audit log?
Highlighted

Sorry @Jacob Airov, I mean the actual searching cmdlets.

Highlighted

following @Vasil Michev's reply, please perform a search using Search-MailboxAuditLog cmdlet

https://technet.microsoft.com/en-us/library/ff522360(v=exchg.160).aspx

Also, you can try searching audit logs in Security and Compliance center, or by running Search-UnifiedAuditLog cmdlet

https://technet.microsoft.com/en-us/library/mt238501%28v=exchg.160%29.aspx?f=255&MSPPError=-21472173...

Highlighted
Highlighted

I have also tested this a little bit in a lab environment.

 

If I drag and drop items from my normal mailbox to a shared mailbox, then I see 'create' events:

 

RecordType   : ExchangeItem
CreationDate : 2/6/2018 3:39:35 PM
UserIds      : rob.wilcox@mydomain
Operations   : Create
AuditData    : {"CreationTime":"2018-02-06T15:39:35","Id":"f3f641a9-ee7d-4512-f346-08d56d77d337","Operation":"Create","
               OrganizationId":"3d8d2c25-3f01-44c4-8451-55c7edd3d196","RecordType":2,"ResultStatus":"Succeeded","UserKe
               y":"10030000A2078A02","UserType":0,"Version":1,"Workload":"Exchange","UserId":"rob.wilcox@mydomain"
               ,"ClientIPAddress":"86.138.186.83","ClientInfoString":"Client=MSExchangeRPC","ClientProcessName":"OUTLOO
               K.EXE","ClientVersion":"15.0.4701.1000","ExternalAccess":false,"InternalLogonType":0,"LogonType":2,"Logo
               nUserSid":"S-1-5-21-3875625135-3762442642-3260609188-6692264","MailboxGuid":"ed664543-080a-4f46-9200-fa0
               0f1f89e81","MailboxOwnerMasterAccountSid":"S-1-5-10","MailboxOwnerSid":"S-1-5-21-3875625135-3762442642-3
               260609188-8243514","MailboxOwnerUPN":"junk@mydomain","OrganizationName":"mydomain.onmicrosoft.com"
               ,"OriginatingServer":"LOXP123MB1224 (15.20.0464.016)\u000d\u000a","Item":{"Id":"RgAAAAC4iGPlAX1lSIThCQIA
               YsbCBwDAuVyFXM\/SQoeCukWN61U0AAAAAAEMAADAuVyFXM\/SQoeCukWN61U0AAB8KSDqAAAJ","ParentFolder":{"Id":"LgAAAA
               C4iGPlAX1lSIThCQIAYsbCAQDAuVyFXM\/SQoeCukWN61U0AAAAAAEMAAAB","Path":"\\Inbox"},"Subject":"test3"}}
ResultIndex  : 3
ResultCount  : 3
Identity     : f3f641a9-ee7d-4512-f346-08d56d77d337
IsValid      : True
ObjectState  : Unchanged

The subject of the message was 'test3' and the path was indeed 'Inbox'

 

But when I delete (soft or hard) I don't see those, I don't see them at all.

 

The query I used is this (though I also tried broader ones as well around this date/time)

 

search-unifiedauditlog -startdate 02/06/2018 -enddate 02/07/2018 -recordtype 'exchangeitem' -userids 'rob.wi lcox@mydomain.com'

 

Highlighted

Auditing works for both type of customers: business as well as regular ones. Thus, the share mailboxes are also subject to the same audit mechanisms. Audit will not be enabled by default in any of the mailboxes, it needs to activated manually.

 

You can try two options: 1. To view log entries w.r.t a specific action, performed by a user of a selected type (owner, delegate or administrator) in a given timespan, run the following PowerShell command:

 

Search-MailboxAuditLog –Identity [user or shared mailbox name] –LogonTypes Owner –ShowDetails –StartDate [start date: d/m/y] –EndDate [end date: d/m/y] | Where-Object {$_.Operation -eq “[action name]”}

 

2.  You can also search the Exchange audit mailbox audit logs through Exchange Control Panel (ECP). Once you start ECP, go to compliance management >auditing.

 

You can also generate the report for actions performed on one or more shared mailboxes, click "Run a non-owner mailbox access report..."

Highlighted

@Jacob Airov 

 

Hi Jacob,

 

Please try to run the below PS script , for me is working

 

Search-MailboxAuditLog -Identity "email address of mailbox/SM”  -LogonTypes Admin,Delegate,Owner -StartDate 11/17/2019 -EndDate 11/28/2019 -ShowDetails | select-object Operation, OperationResult, LogonType, logonuserdisplayname, SourceItemSubjectsList, itemsubject, SourceItemFolderPathNamesList, LastAccessed, InternalLogonType, MailboxOwnerUPN, ClientIPAddress,ClientProcessName,ClientInfoString, ClientVersion | export-csv .\Desktop\Auditlog.csv -Encoding Unicode

 

Hope it helps.

Costin