Hi all,

Like to check what is the event id that will appear on Windows Event Viewer when a mailbox is access by someone else?

For exchange 2007, the event id is 10100. I cannot seems to find the id for 2013 on the net.

Also, if I wish to monitor exchange administrator if they are accessing any other person's mailbox,

Would this power shell command be enough to turn on what I wish to monitor?

Set-Mailbox -AuditEnabled:$true

Thanks!

Zack

• Edited by Zack Ng Saturday, April 18, 2015 12:43 PM

Hi Zack,

Thank you for your question.

Mailbox audit logs are generated for each mailbox that has mailbox audit logging enabled. Log entries are stored in the Recoverable Items folder in the audited mailbox, in the Audits subfolder. By default, mailbox audit log entries are retained in the mailbox for 90 days and then deleted. We could modify this retention period by using the AuditLogAgeLimit parameter with the Set-Mailbox cmdlet. We could use the following command to enable mailbox audit logging:

Set-Mailbox Identity <Username/Email address> -AuditEnable $ture

To verify that we have successfully enabled mailbox audit logging for a mailbox and specified the correct logging settings for administrator, delegate, or owner access, use the Get-Mailbox cmdlet to retrieve the mailbox audit logging settings for that mailbox.

This example retrieves Ben Smiths mailbox settings and pipes the specified audit settings, including the audit log age limit, to the Format-List cmdlet.

Get-Mailbox "Ben Smith" | Format-List *audit*

The more details will be referred by the following link:

https://technet.microsoft.com/en-us/library/ff459237(v=exchg.150).aspx

If there are any questions regarding this issue, please be free to let me know. 

Best Regard,

Jim