Share via

SecureScore - "Enable mailbox auditing for all users"

Anonymous
2017-03-31T09:18:13+00:00

Hi,

We are trying to make good use of the SecureScore portal to increase the security settings on our Office365 tenancy. The latest one we've been looking at is "Enable mailbox auditing for all users".

Following the links that the further information page gives takes you to a page with a Powershell script. We have run this script, which appears to target user mailboxes in particular. The portal now reports that we are still not fully compliant, but that 46 of our 71 mailboxes are.

The 25 remaining mailboxes I assume will be our shared mailboxes and resource (room) mailboxes. Is there a reason why the provided script doesn't cover these since I can't imagine there will be many companies who won't have shared and resource mailboxes too? As things stand it's not possible for us to get the 'score' with the provided script.

Thanks!

Stephen.

Microsoft 365 and Office | Subscription, account, billing | For home | Windows

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

  1. Anonymous
    2017-03-31T13:06:54+00:00

    Hi Stephen,

    I understand that you want to enable auditing for all mailboxes in your organization (user mailboxes, shared mailboxes, room mailboxes and equipment mailboxes). Please refer to the following steps to achieve the goal:

    1. Connect to Exchange Online PowerShell using an Office 365 administrator account.
    2. Run the command below:

    Get-Mailbox -ResultSize Unlimited -Filter {RecipientType -eq "UserMailbox"} | Set-Mailbox -AuditEnabled $true

    To verify that you have successfully enabled mailbox audit logging for all those mailboxes, you can run the following to check it.

    Get-Mailbox -ResultSize Unlimited -Filter {RecipientType -eq "UserMailbox"} | FL Name,Audit*

    Here is an article for reference: Enable mailbox auditing in Office 365.

    Let us know if anything is unclear.

    Best Regards,

    Aaron

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments

7 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2017-04-10T08:43:19+00:00

    Will do, that's a good idea. I'd also suggest it would be helpful if the support link already there pointed to a script which included your suggestion, thereby helping other people.

    Kind regards,

    Stephen.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  2. Anonymous
    2017-04-04T09:02:51+00:00

    Hi Stephen,

    If you run the command with parameter “RecipientTypeDetails” as what you mentioned above, it will only enable audit for all user mailboxes. If you run the command with parameter “RecipientType” as what I mentioned above, it will enable audit for all your user mailboxes, shared mailboxes, room mailboxes and equipment mailboxes.

    To run which command is based on your requirement. Feel free to post back if you have any further concern.

    Thanks,

    Aaron

    Was this answer helpful?

    0 comments
  3. Anonymous
    2017-04-03T10:30:03+00:00

    Hi Aaron,

    Thanks for your reply, sorry for not getting back sooner.

    The suggested solution provided by the Office 365 SecureScore portal points to: https://github.com/OfficeDev/O365-InvestigationTooling/blob/master/EnableMailboxAuditing.ps1

    The command as you can see below is very similar to the one you suggest:

    Get-Mailbox -ResultSize Unlimited -Filter {RecipientTypeDetails -eq "UserMailbox"} | Set-Mailbox -AuditEnabled $true -AuditLogAgeLimit 365

    Yet, having run it, SecureScore says "We found that you had 46 mailboxes of 71 with audited enabled. If you enable mailbox auditing on all of your mailboxes, your score will go up 10 points."

    Looking at TechNet would I not need to rerun the command with a different RecipientTypeDetails value set?

    Thanks!

    Stephen.

    Was this answer helpful?

    0 comments
  4. Anonymous
    2017-04-01T15:36:23+00:00

    Hi Stephen,

    Do you still need assistance?

    Thanks,

    Aaron

    Was this answer helpful?

    0 comments