Hello All, I have a interesting question,I activated Mailbox Audit Logging but when I try to sarch mail logs (I write below command) it always just goes a line below,there is nothing after run thise command,is this wrong ? Search-MailboxAuditLog -Identity test -LogonTypes Owner -ShowDetails -StartDate 11/20/2012 -EndDate 11/21/2012 | Where-Object {$_.Operation -eq "HardDelete"}Also I can't see anything in ECP,is my command true?Set-Mailbox -Identity "user" -AuditEnabled $true

Hello, I tested in my environment, get the same result with you. I will do more research and post the updates. Thanks, EvanEvan Liu TechNet Community Support

Hello, I 'think there should be bug for this version,isn't it ?

Hello, any news? iy may certificate problem on DC but I can't find anything :(

Hi, I don't think you have enabled any actions made by the mailbox owner to audit and that is something you need to do manually. Just running Set-Mailbox -Identity "user" -AuditEnabled $True will not do that for you. See: Mailbox Audit Logging Martina Miskovic

Hi Martina, I've tried lots of kind like your sample but still same,but when I look situation of user it seems enabled; AuditEnabled : True AuditLogAgeLimit : 90.00:00:00 AuditAdmin : {Update, Move, MoveToDeletedItems, SoftDelete} AuditDelegate : {Update, SoftDelete, HardDelete, FolderBind, SendAs, Create} AuditOwner : {HardDelete}

Search-MailboxAuditLog -Identity test -LogonType Owner -ShowDetails -StartDate (Get-Date).AddDays(-1) -EndDate (Get-Date) or Search-MailboxAuditLog -Identity test -LogonType Owner -ShowDetails -StartDate [datetime]"11/20/2012" -EndDate [datetime]"11/21/2012"stefan@xperta

problem is not search capabilty,I can't see also in ECP console, it can't be activated,,

Yeah, but it's the owner you are trying to show. I've yet to figure out how to do that in ECP, only have it working in EMS.stefan@xperta

problem is not search capabilty,I can't see also in ECP console, it can't be activated,, I can't reproduce your problem. Search-Mailboxauditlog works just fine for me. It's not possible to use EAC to search in these logs. See: Search the Mailbox Audit Log for a Mailbox Martina Miskovic

Have you actually HardDeleted any items? On the parameter -AuditOwner on Set-Mailbox you can have: http://technet.microsoft.com/en-us/library/bb123981.aspx The AuditOwner parameter specifies the operations to log for mailbox owners. Valid values include: NoneUpdateMoveMoveToDeletedItemsSoftDeleteHardDelete HardDelete is purging something from "Recover from deleted items"stefan@xperta

Hi Martina, Exchange 2013 provides us this feature,you can see EAC-->Compliance Management-->Auditing, Hi Stefan, I delete mail from Recover from deleted items many times but result same :( Hi Evan Liu, could you find something about that ?

Hi Martina, Exchange 2013 provides us this feature,you can see EAC-->Compliance Management-->Auditing, Sure, but it is not possible to use that to search for specific operations, like harddelete for example.Martina Miskovic

Hi Evan Liu, could you find something about that ? Hi msik, Today I did more test for this. I found it will get result after I use another client (connect to Exchange Server) and hard delete one email. Thanks, EvanEvan Liu TechNet Community Support

Thank you so much Evan Liu and other friends, you're right after I change user it worked well,thanks again,,,