Monitoring logging can be used to log certain actions for mailboxes. This function is particularly useful for mailboxes to which several users have access. For example, it is possible to track which user has replied to a certain mail or who has deleted which mail. Audit logging can also be helpful for normal user mailboxes. Although the audit logs are not usually helpful for error analysis, they can be used to determine what the user has done with a mail.
By default, the mailbox audit logs are deactivated and can be activated for each mailbox. The mailbox audit logs are saved for 90 days in the default setting.
The following actions are logged for mailboxes with activated Mailbox Audit Logging:
Configuring the monitoring logging
To activate mailbox audit logging for a specific mailbox, the following command can be used:
Get-Mailbox frank | Set-Mailbox -AuditEnabled $true
The following command can be used to activate monitoring logging for all mailboxes:
Get-Mailbox -ResultSize Unlimited | Set-Mailbox -AuditEnabled $true
Logging can be switched off for an individual mailbox or for all mailboxes using the following commands:
Get-Mailbox Frank | Set-Mailbox -AuditEnabled $false Get-Mailbox -ResultSize Unlimited | Set-Mailbox -AuditEnabled $false
By default, the retention period for the mailbox audit logs is 90 days; this limit can be adjusted with the following commands (for example, to 180 days for a single mailbox or for all mailboxes):
Get-Mailbox Frank | Set-Mailbox -AuditLogAgeLimit 180 Get-Mailbox -ResultSize Unlimited | Set-Mailbox -AuditLogAgeLimit 180
Depending on the activity of the user and the duration of log storage, the storage requirements of the mailbox increase. The increased space requirement must therefore be taken into account. Before monitoring is activated for all mailboxes, this should initially only be configured for a few mailboxes so that the additional space requirement can be estimated.
Checking the monitoring log
Once logging has been activated, a new folder called "Audits" is created in the user's mailbox. The monitoring events are saved in this folder. The user cannot access the "Audits" folder and it is not displayed in Outlook. The Exchange Management Shell can be used to check whether the folder has been created and whether events have already been saved. The following command can be used for this purpose:
get-mailbox frank | Get-MailboxFolderStatistics | where {$_.name -eq "Audits"} | ft name,itemsinfolder
The screenshot shows that the "Audits" folder was created in the "Frank" mailbox and already contains 5 events. In this way, you can also check the memory requirements of the monitoring log:
get-mailbox frank | Get-MailboxFolderStatistics | where {$_.name -eq "Audits"} | ft name,itemsinfolder,foldersize
Retrieving the logs
For a user to be able to view the monitoring logs, the user must be a member of the AD group "Compliance Management". By default, no user has the right to view the logs. The following command can be used to add a user to the "Compliance Management" group:
Add-RoleGroupMember "Compliance Management" -Member administrator
This process is also possible directly via the Active Directory console or via the Exchange Admin Center.
Often only the monitoring logs for a specific user are required. The quickest way is to display the log directly on the Exchange Management Shell. For a single user, this works with the following command:
Search-MailboxAuditLog frank -ShowDetails -StartDate ((get-date).AddDays(-2)) -EndDate (get-date)
In this case, the events of the last 2 days for the user "Frank" are displayed in the shell:
If required, the events can be filtered accordingly. Here, for example, all events of the last 2 days in which a "HardDelete" was executed (mail deleted with Shift+Delete):
Search-MailboxAuditLog frank -ShowDetails -StartDate ((get-date).AddDays(-2)) -EndDate (get-date) | where {$_.Operation -eq "HardDelete"}
There is also a way to access the monitoring logs in the Exchange Admin Center. In this case, the results are sent to a recipient by email as an XML file. The XML file can then be further processed using PowerShell or other tools.
The logs can be retrieved as follows in the Exchange Admin Center:
You can then define for which users the mailbox monitoring logs are to be exported and who the recipient of the results is:
The delivery of the results by mail and XML file can also be triggered directly from the Exchange Management Shell using the following command:
New-MailboxAuditLogSearch "hans3" -Mailboxes hans,frank -StatusMailRecipients frank@frankysweb.org -StartDate ((get-date).AddDays(-2)) -EndDate (get-date) -ShowDetails
The following screenshot shows a corresponding e-mail and the XML file:
The XML file can then be filtered or further processed using appropriate tools. PowerShell can also be used here:
Note
Wenn der Exchange Server auf einem “nicht englisch sprachigem” Server installiert wurde, werden keine Audit Logs angezeigt. Hier hilft es die Sprache auf “English – US” umzustellen: