Exchange audit folder moves

ChrisMKV 6

After doing some research, it seems that Mailbox Auditing doesn't log folder moves. Not the folder itself, nor any of the items contained.

Seems to me that is a huge oversight, as it means it's very easy to defeat auditing if there is a retention policy on deleted items: Simply move an entire folder into deleted items (not audited), where they're eventually expired by the retention policy.

Sadly this means the Audit log can't be a reliable way to get proof of what happened in a Mailbox. Is anyone aware of eventual workarounds or plans from Microsoft to enable this?

Thanks

Kael Yao-MSFT 37,496 Reputation points Microsoft Vendor

2022-04-08T08:06:22.88+00:00

Hi @ChrisMKV

Just checking in to see if above information was helpful. Please let us know if you would like further assistance.

1 answer

Vasil Michev 95,836 Reputation points MVP

2022-04-04T16:49:32.437+00:00
"Move" is one of the available operations for audit. It is not however enabled by default, so you need to add that first. As in:

Set-Mailbox vasil -AuditDelegate @{add="Move"}

Refer to the documentation for more details: https://learn.microsoft.com/en-us/exchange/policy-and-compliance/mailbox-audit-logging/mailbox-audit-logging?view=exchserver-2019#mailbox-actions-logged-by-mailbox-audit-logging
Please sign in to rate this answer.

1 person found this answer helpful.
ChrisMKV 6 Reputation points

2022-04-08T16:04:20.443+00:00

Thank you michev, we had already enabled this and also MoveToDeletedItems (any any other audit option that can be enabled really). It's working fine for mails, but not folders or their content unfortunately. The same was now confirmed to us when we opened a support ticket by Microsoft, if a folder is moved, no audit log is generated at all.

[PS] C:\>Get-Mailbox -Identity xxx | select -ExpandProperty "AuditDelegate"
Update
Move
MoveToDeletedItems
SoftDelete
HardDelete
FolderBind
SendAs
SendOnBehalf
Create

Kael Yao-MSFT 37,496 Reputation points Microsoft Vendor

2022-04-11T02:03:26.957+00:00

Thanks for the sharing.

Neil Ticktin 6 Reputation points

2023-11-13T22:25:20.8433333+00:00

@Vasil Michev (or someone else, since it's been a while on this thread)...

This is incredibly useful. With Mailbox Auditing enabled, it appears that the defaults don't include all as you said:

>> Get-Mailbox -Identity xyz@mail..com | Select-Object -ExpandProperty AuditDelegate which results in: Update MoveToDeletedItems SoftDelete HardDelete SendAs SendOnBehalf Create UpdateFolderPermissions UpdateInboxRules ApplyRecord

While we don't need this for admins, or the mailbox owner, I think that if we could add "Move" for delegates access to being part of the default for all mailboxes with delegate access, that would be great.

I can maintain this manually, one mailbox at a time, via PowerShell, but I'd prefer to just be able to say "Hey Microsoft, for this tenant, on all mailboxes, include 'Move' in the mailbox audits." Is there a way to make this the default behavior for the tenant?

Thanks!

Neil

Neil Ticktin 6 Reputation points

2023-11-15T23:32:59.4766667+00:00

@Vasil Michev By chance, did you have a moment to look at this?
Sign in to comment