How to audit or track deleted emails from Shared mailbox

Question

Hello,

We have Exchange 2019 DAG, looking for the command to audit deleted emails from the Shared mailbox which has multiple full access permission users.

Thanks

Answer 1

Follow the instruction in this article: https://learn.microsoft.com/en-us/exchange/search-the-mailbox-audit-log-for-a-mailbox-exchange-2013-help

Answer 2

Hi,

You can try to use Search-MailboxAuditLog (ExchangePowerShell) | Microsoft Learn  to search for audit logs of deletions on shared mailboxes, example command: Search-MailboxAuditLog -Identity share1 - -ShowDetails -Operations HardDelete,SoftDelete,MoveToDeletedItems -StartDate 4/20/2024 -EndDelete LogonTypes Delegate -ShowDetails -Operations HardDelete,SoftDelete,MoveToDeletedItems -StartDate 4/20/2024 -EndDate 4/25/2024.

share1 is the name of my shared mailbox, the StartDate and EndDate attributes should be filled with the start and end dates you want to audit.

But the prerequisite for getting the results you want is that you have previously enabled mailbox audit logging for that mailbox, using Set-Mailbox -Identity share1 -AuditEnabled $true enables mailbox audit logging. If it prompts like this, then you have enabled audit logging for the mailbox.

Please feel free to contact me for any updates.