Create a Mailbox Audit Log Search

 

Applies to: Exchange Server 2010 SP3, Exchange Server 2010 SP2

You can create a mailbox audit log search to asynchronously search one or more mailboxes and have the search results sent by e-mail as an XML file to specified addresses.

Note

By default, mailbox audit logging is disabled for all mailboxes. For each mailbox you want to audit, you must enable audit logging and specify the mailbox owner, delegate, or administrator actions you want to audit. For more details, see Enable or Disable Mailbox Audit Logging for a Mailbox.

To search mailbox audit logs for a single mailbox and have the results displayed in the Shell, see Search the Mailbox Audit Log for a Mailbox.

Looking for other management tasks related to mailbox audit logging? Check out Managing Mailbox Audit Logging.

Use the Shell to create a mailbox audit log search

You need to be assigned permissions before you can perform this procedure. To see what permissions you need, see the "Mailbox audit logging" entry in the Messaging Policy and Compliance Permissions topic.

Note

You can't use the Exchange Management Console (EMC) to create a mailbox audit log search.

This example creates the mailbox audit log search Admin and Delegate Access to search Ken Kwok's and April Stewart's mailboxes for administrator and delegate logons from 1/1/2010 to 12/31/2010. The search results are sent by e-mail to auditors@contoso.com.

New-MailboxAuditLogSearch "Admin and Delegate Access" -Mailboxes "Ken Kwok","April Stewart" -LogonTypes Admin,Delegate -StartDate 1/1/2010 -EndDate 12/31/2010 -StatusMailRecipients "auditors@contoso.com"

For detailed syntax and parameter information, see New-MailboxAuditLogSearch.

Other Tasks

After you create a mailbox audit log search, you may also want to enable or disable mailbox audit logging. For detailed steps, see Enable or Disable Mailbox Audit Logging for a Mailbox.

 © 2010 Microsoft Corporation. All rights reserved.