Hello,

I have been requested to report on the activity of a user's email account in exchange 2013.

I am wondering what my options are for reporting on Messages Sent, Received, and Deleted if possible.

I see there is Auditing but not sure if it offers what I am looking for, not saying it doesn't but that I'm not exactly sure what all it offers in terms of reporting, after reading into it a bit it didn't seem to offer these services but I could be mistaken.

When Exchange was configured there were not modifications to the Auditing settings, I'm not sure if Auditing is set to True by default but I suspect it isn't so in this case wouldn't work regardless.

I have access to the account through delegation, so apart from emails their previously deleted, I think I could create a report just through Outlook.

Any insight is much appreciated.

Thanks.

Hi,

To check if this mailbox has enabled Mailbox Audit Logging, we can use the following command.

Get-mailbox identity user name | fl *audit*

We can also use this command to check mailbox audit logging entries under Admin, Delegate and Owner. By default, there are no entry under AuditOwner, we can use the following command to set these entries. We can use Mailbox Audit Logging to log these operations: Copy, Create, FolderBind, HardDelete, MessageBind, Move, MoveToDeletedItems, SendAs, SendOnBehalf, SoftDelete, Update

Set-mailbox identity user name AuditOwner Copy, Create, FolderBind, HardDelete, MessageBind, Move, MoveToDeletedItems, SendAs, SendOnBehalf, SoftDelete, Update

Then we use Search- MailboxAuditLog cmdlet to search mailbox audit log

Search-MailboxAuditLog -identity "user name" -LogonTypes owner ShowDetails

Note: If you specify the Owner logon type, you must use the ShowDetails switch.

In addition, we can use the Get-MailboxStatistics cmdlet to obtain information about a mailbox, such as the size of the mailbox, the number of messages it contains, and the last time it was accessed.

Best Regards.

• Edited by Lynn-Li 8 hours 22 minutes ago

As  suggested above, Mailbox audit logging would be a good start-up to track all the sent/received emails by specific user.

By the way, if you still unable to get the desired result, you may also give a shot to this automated solution (http://www.exchangereports.net/) that helps to gather the minutest details on different characteristics of Exchange mailboxes into real time. You can track mailbox traffic of the entire network with the detail information such as, all emails sent and received within a particular duration, emails sent outside and inside organization etc.