I have Exchange 2010 sp2 , I have enabled mailbox audit on few mailbox , as well as MSExchange IS logs for logon event to expert.(event ID 1016),
I am trying to get folderbind events , from shared calender access , like Non-owner mailbox event or anything that I can run audit get the detail if non-owner accessed the calender or mailbox folder etc..
I found changes are logged like create , delete or any changes but not folderbind
i have following on to few mailboxes.
AuditEnabled : True
AuditLogAgeLimit : 90.00:00:00
AuditAdmin : {Update, Move, MoveToDeletedItems, SoftDelete, HardDelete, FolderBind, SendAs, SendOnBehalf, Create}
AuditDelegate : {Update, Move, MoveToDeletedItems, SoftDelete, HardDelete, FolderBind, SendAs, SendOnBehalf, Create}
AuditOwner : {Update, Move, MoveToDeletedItems, SoftDelete, HardDelete, Create}
Can some one please help me to find what is missing to get folderbind audit events when any non-owner access anything like shared calender etc..
Thank you