You have to enable mailbox audit logging for each mailbox that you want to run a non-owner mailbox access report for. If mailbox audit logging isn't enabled for a mailbox, you won't get any results for that mailbox when you export the mailbox audit log.

You need to be assigned permissions before you can perform this procedure or procedures. To see what permissions you need, see the "Mailbox audit logging" entry in the Messaging Policy and Compliance Permissions topic.

To enable mailbox audit logging for a single mailbox, run the command in the Shell.

	Copy Code
Set-Mailbox <Identity> -AuditEnabled $true

To enable mailbox audit logging for all user mailboxes in your organization, run the following commands.

	Copy Code
$UserMailboxes = Get-mailbox -Filter {(RecipientTypeDetails -eq 'UserMailbox')}

	Copy Code
$UserMailboxes | ForEach {Set-Mailbox $_.Identity -AuditEnabled $true}

When you export the mailbox audit log, Microsoft Exchange attaches the audit log, which is an XML file, to an email message. However, Outlook Web App blocks XML attachments by default. To access the exported audit log, you have to use Microsoft Outlook or configure Outlook Web App to allow XML attachments.

You need to be assigned permissions before you can perform this procedure or procedures. To see what permissions you need, see the "Outlook Web App mailbox policies" entry in the Clients and Mobile Devices Permissions topic.

Run the following command to allow XML attachments in Outlook Web App.

	Copy Code
Set-OwaMailboxPolicy -Identity Default -AllowedFileTypes '.rpmsg','.xlsx','.xlsm','.xlsb','.tiff','.pptx','.pptm','.ppsx','.ppsm','.docx','.docm','.zip','.xls','.wmv','.wma','.wav','.vsd','.txt','.tif','.rtf','.pub','.ppt','.png','.pdf','.one','.mp3','.jpg','.gif','.doc','.bmp','.avi','.xml'

Note:
In Exchange Online, use the value OwaMailboxPolicy-Default for the Identity parameter.

To verify that you’ve successfully configured mailbox audit logging, do the following:

1. Run the following command to verify that audit logging is configured for mailboxes.
   
   

   	Copy Code
   Get-Mailbox | FL Name,AuditEnabled

   A value of True for the AuditEnabled property verifies that audit logging is enabled.
   
   
2. Run the following command to verify that XML attachments are allowed in Outlook Web App for your organization.
   
   

   	Copy Code
   Get-OwaMailboxPolicy | Select-Object -ExpandProperty AllowedFileTypes

   Verify that .xml is included in the list of allowed file types.
   
   

Sign in to the mailbox where the mailbox audit log was sent. If you’ve successfully exported the audit log, you’ll receive a message sent from Exchange. The audit log will be attached to this message. As previously stated, in Exchange Online, it may take up to 24 hours to receive this message.

The following example shows an entry from the mailbox audit log contained in the SearchResult.xml file. Each entry is preceded by the <Event> XML tag and ends with the </Event> XML tag. This entry shows that the administrator purged the message with the subject, "Notification of litigation hold" from the Recoverable Items folder in David's mailbox on April 30, 2010.

Copy Code

<Event MailboxGuid="6d4fbdae-e3ae-4530-8d0b-f62a14687939" Owner="PPLNSL-dom\david50001-1363917750" LastAccessed="2010-04-30T11:01:55.140625-07:00" Operation="HardDelete" OperationResult="Succeeded" LogonType="Admin" FolderId="0000000073098C3277988F4CB882F5B82EBF64610100A7C317F68C24304BBD18ABE1F185E79B00000026BD4F0000" FolderPathName="\Recoverable Items\Deletions" ClientInfoString="Client=OWA;Action=ViaProxy" ClientIPAddress="10.196.241.168" InternalLogonType="Owner" MailboxOwnerUPN=david@contoso.com MailboxOwnerSid="S-1-5-21-290112810-296651436-1966561949-1151" CrossMailboxOperation="false" LogonUserDN="Administrator" LogonUserSid="S-1-5-21-290112810-296651436-1966561949-1149"> <SourceItems> <ItemId="0000000073098C3277988F4CB882F5B82EBF64610700A7C317F68C24304BBD18ABE1F185E79B00000026BD4F0000A7C317F68C24304BBD18ABE1F185E79B00000026BD540" Subject="Notification of litigation hold" FolderPathName="\Recoverable Items\Deletions" /> </SourceItems> </Event>

Watch for these fields. They can help you identify specific information about each instance of non-owner access of a mailbox.

If you can view the XML file that’s attached to the message sent by Exchange and the file contains audit log entries, then you’ve successfully configured, exported, and viewed a mailbox audit log.