I have some queries regarding MS exchange 2007. It would be great if you guyscan help me out. 1.) Which are the logs in which the user access , Login/Logout information iscaptured? 2.) Are the security logs different from the application logs? If yes, Does the user access tracking, login/logout etc( regarding authentication) get logged in the security logs? 3.) Is there a way to filter the logs which are specific to MS exchange user access, login/logoutin the event viewer ? Thanks, Yuvika

Hi, You can run cmdlt to audit mail box access. Set-EventLogLevel MSExchangeIS\9000 Private\Logons LevelHigh to enable Event Logging. How to Change Logging Levels for Exchange Processes http://technet.microsoft.com/en-us/library/bb201670(EXCHG.80).aspx Set-EventLogLevel http://technet.microsoft.com/en-us/library/aa998905(EXCHG.80).aspx Processes with Configurable Event Logging Levels http://technet.microsoft.com/en-us/library/bb201661(EXCHG.80).aspx Hope it helps. Xiu