Hi all,

Like to check what is the event id that will appear on Windows Event Viewer when a mailbox is access by someone else?

For exchange 2007, the event id is 10100. I cannot seems to find the id for 2013 on the net.

Also, if I wish to monitor exchange administrator if they are accessing any other person's mailbox,

Would this power shell command be enough to turn on what I wish to monitor?

Set-Mailbox -AuditEnabled:$true

Thanks!

Zack

• Edited by Zack Ng Saturday, April 18, 2015 12:43 PM

Hi,

I hope, the above given suggestions would be good approach to resolve your concern in depth.

However, you may walk through this informative PDF guide that provides step-wise instructions to enable auditing for non-owner mailboxes and track every critical access into real time : https://gallery.technet.microsoft.com/Enabling-Exchange-2010-368786d3

Moreover, if you wish to get such critical information using automated solution, LepideAuditor suite could also be a good approach for you that helps to audit Non-Owner and Owner Mailbox Access and provides granular level reports by meeting all the required aspects.

Hi all,

I have 2 questions:

[1] If I wish to turn on all mailbox auditing, the command "Set-Mailbox -AuditEnabled:$true" will applies for all existing mailbox as well as all mailbox created thereafter is that correct?

[2] If I wish to turn on "Add-MailboxPermission" auditing for all mailbox, which cmdlets or/and cmdlet parameters command do I need to use?

Thanks!

Hi Zack,

[1] If I wish to turn on all mailbox auditing, the command "Set-Mailbox -AuditEnabled:$true" will applies for all existing mailbox as well as all mailbox created thereafter is that correct?

A: This command will work for existed mailboxes. if we create new mailboxes, we will run the command again.

[2] If I wish to turn on "Add-MailboxPermission" auditing for all mailbox, which cmdlets or/and cmdlet parameters command do I need to use?

A:  I am sorry that I didnt understand this question, but we could refer to the following link:

https://technet.microsoft.com/en-us/library/bb124097%28v=exchg.150%29.aspx

If there are any questions regarding this issue, please be free to let me know. 

Best Regard,

Jim

Hi Jim,

Thanks for your prompt reply.

for [2], I mean if I wish to audit event whenever a "Add-MailboxPermission" command is used, to track who issue the command and what is the permission given to; Is there a setting or command that I need to issue before I can audit these events?

e.g. http://www.msexchange.org/img/upl/image0091274898441846.jpg