Hi I know you can use the following command to run audit logs in Exchange 2007. Set-EventLogLevel "MSExchangeIS\9000 Private\Logons" -Level Low But how do I set it up for individual mailboxes? I cannot seem to figure it out. Apologies, I'm new to Exchange 2007. Thank you in advance Stef G

Hello Stef, It is not possible to eanble logon audit on user basis, you need to enable it on a server where users' mailbox is available.Amit Tank | MVP - Exchange | MCITP:EMA MCSA:M | http://ExchangeShare.WordPress.com