Applies to: Exchange Server 2013
Topic Last Modified: 2012-10-03
You can synchronously search mailbox audit log entries for a mailbox and have the search results displayed in the Shell.
If you want to search mailbox audit logs for multiple mailboxes and have the results emailed to a specified address, you must create a mailbox audit log search instead. For details, see Create a Mailbox Audit Log Search.
For additional management tasks related to mailbox audit logging, see Mailbox Audit Logging Procedures.
What do you need to know before you begin?
- Estimated time to complete: 1 minute.
- You need to be assigned permissions before you can perform this
procedure or procedures. To see what permissions you need, see the
"Mailbox audit logging" entry in the Messaging Policy and
Compliance Permissions topic.
- By default, mailbox audit logging is disabled for all
mailboxes. For each mailbox you want to audit, you must enable
audit logging and specify the mailbox owner, delegate, or
administrator actions you want to audit. For details, see Enable or Disable
Mailbox Audit Logging for a Mailbox.
- You can't use the EAC to search the mailbox audit log for a
mailbox. However, you can use the EAC to run or search for and
export a non-owner mailbox access report.
- For information about keyboard shortcuts that may apply to the
procedures in this topic, see Keyboard Shortcuts in
the Exchange Admin Center.
 Tip: |
|---|
| Having problems? Ask for help in the Exchange forums. Visit the forums at: Exchange Server, Exchange Online, or Exchange Online Protection |
Use the Shell to search the mailbox audit log for a mailbox
For examples of how to use the Shell to search the mailbox audit log for a mailbox, see Examples in Search-MailboxAuditLog.