Hi I have a requirement in which I am supposed to do what is requested below. The idea is to take advantage of enhancements in Exchange 2007 SP2 (http://technet.microsoft.com/en-us/library/ee221156(EXCHG.80).aspx ). Basically not every security related event needs to be captured, instead only the following is needed to be done which will reduce our capture data and become more manageable. Well Third party app is not an option. Essentially the auditing has to be limited to only to the below two points. •Capture all events where a member of the administration team has opened a folder or message on another mailbox other than their own. •Capture all events where a member of the administration team has changed permissions on a mailbox other than their own. All help is appreciated.