Is there any way to record the actions of a user downloading an attachment, or even just opening an email to view the contents.

We have a 16 core quad processor machine with 200GB ram and 24 SSD disks. There are only 16 mailboxes and users will  be using the exchange server aprox four times a month and then only undertaking a couple of actions (such as downloading/uploading an attachment). Users will be aware of the auditing

Hi,

In Exchange, we can enable audit logging for a mailbox then specify which user actions will be logged. However we cannot log the action about downloading attachment.

A workaround I can think of is to create a transport rule to Bcc the mails with attachment to another mailbox for audit.

Condition: any attachment is greater than or equal to limit  (1KB)

Action: Bcc the message to addresses

Best Regards.