Comments on: Mailbox Access Auditing with Exchange 2007 SP2

By: Vaibhav

Vaibhav — Fri, 02 Dec 2011 11:50:46 +0000

How can i find who all logged in to users mailbox in last 15 days ?

Get-MailboxStatistics | Select DisplayName, LastLoggedOnUserAccount ? this is giving me just last logon, i need to find all logon as well as type of logon ( exp | OWA / MAPI )

By: Panji

Panji — Mon, 31 Oct 2011 01:16:20 +0000

Hi,
How if i will viewing log for who has someone change my alias?

Thanks,
Panji Indonesia

By: tal

tal — Thu, 21 Jul 2011 12:18:21 +0000

Is there any answer about the last reply? Does anyone know anything about accessing to different outlook mailbox – it should appear in event 1029 but it shows me this in the application log instead of the exchange auditing. Why is that and how can I change it?

By: Frank Fernandez

Frank Fernandez — Tue, 22 Mar 2011 13:39:33 +0000

Absolutely great article! Good job and thank you. I have one hiccup. I configured through the EMC GUI, Server Config/Mailbox/click on my only exchange server/Manage Diagnos…../9000 Private/Folder Access and Message Access and both set to HIGH which I assume is equal to 4 on your detail above. Restarted IS and it logs everything (i.e. John Accesing John). What I need it to do is when any user accesses any other users mailbox ONLY (i.e. John accesses Robert). Unsure what I am doing wrong.

By: Ratish Sekhar

Ratish Sekhar — Sat, 12 Feb 2011 09:29:14 +0000

@kloby/Will – Just added the update to restart the IS service. Thanks for pointing.

By: Will Martin

Will Martin — Wed, 02 Feb 2011 18:23:40 +0000

The Microsoft pages that explain this feature all state that after making changes to the logging levels, in order for them to go into affect, you need to restart the Information Store service. Not sure why this article skipped this bit of information, but it is certainly documented on the Microsoft website.

By: Wayne

Wayne — Mon, 17 Jan 2011 16:31:35 +0000

This was a thorn in my side for 2days until I found the comments on this site. Checked all the MS sites, checked the bypass on many users and it turns out all I had to do was restart the store to get the logging to show in the event log.

If this is so common why do none of the articles mention this? Crazy….

Thanks Guru! and comment guys

By: kloby

kloby — Thu, 18 Nov 2010 08:41:56 +0000

Well, i started logging and I can only see logs in event viewer (windows logs/application) but nothing is looged in Exchange auditing ?
why ?

##Update## –> Restart information store service.

By: Ricky114

Ricky114 — Tue, 26 Oct 2010 12:46:02 +0000

please have a look to this intersting article:
http://blogs.technet.com/b/mikelag/archive/2010/06/23/audit-exchange-2007-sp2-auditing.aspx

seems that for *Admins* gorup you will find in a situation where bypassa auditing is set ( actually i’m expereincing such situation..)

i found also interesting this other article:
http://technet.microsoft.com/en-us/library/ee331009(EXCHG.80).aspx

it explain that level 2 and 4 of loggin can be set just via command shell..

By: Ratish Sekhar

Ratish Sekhar — Mon, 25 Oct 2010 15:15:25 +0000

It can be seen in Event Viewer -> Applications & Services Log -> Exchange Auditing and log file size can be configued in properties just like any other logs.