Share via

Search the mailbox audit log for a mailbox

  • Article

Applies to: Exchange Server 2013

You can synchronously search mailbox audit log entries for a mailbox and have the search results displayed in the Shell.

If you want to search mailbox audit logs for multiple mailboxes and have the results emailed to a specified address, you must create a mailbox audit log search instead. For details, see Create a mailbox audit log search.

For additional management tasks related to mailbox audit logging, see Mailbox audit logging procedures.

What do you need to know before you begin?

  • Estimated time to complete: 1 minute.

  • You need to be assigned permissions before you can perform this procedure or procedures. To see what permissions you need, see the "Mailbox audit logging" entry in the Messaging policy and compliance permissions topic.

  • By default, mailbox audit logging is disabled for all mailboxes. For each mailbox you want to audit, you must enable audit logging and specify the mailbox owner, delegate, or administrator actions you want to audit. For details, see Enable or disable mailbox audit logging for a mailbox.

  • You can't use the EAC to search the mailbox audit log for a mailbox. However, you can use the EAC to run or search for and export a non-owner mailbox access report.

  • For information about keyboard shortcuts that may apply to the procedures in this topic, see Keyboard shortcuts in the Exchange admin center.

Tip

Having problems? Ask for help in the Exchange forums. Visit the forums at Exchange Server.

Use the Shell to search the mailbox audit log for a mailbox

For examples of how to use the Shell to search the mailbox audit log for a mailbox, see Examples in Search-MailboxAuditLog.