Is there any way to find out when sharing a users mailbox has been done? Customer wants to know when certain users mailboxes has been shared to other people.

Or is the last modified date only data I can get out from the exchange? I know that you cant find out who has done the changes.

• Edited by FINaa Wednesday, August 28, 2013 5:30 AM

Hello,

In exchange server, there is no way to check when the certain users' mailbox has been shared to other people.

Hello

Thank you for your answer.

Hi FiNaa,

I would like to know ,  Where are you sharing Mailbox , In Exchange  or  from Outlook  itself ?

Hi Tarique,

Customer is suspecting that old worker who had admin righs have shared others mailboxes for himself in Exchange before leaving. They would like to know is it true and has it happen right before he left.

Users are sharing their own mailboxes in Outlook.

Hi,

In Exchagne  you can check the Shared mailbox and who are accessing this  by running the following cmdlet :

Get-Mailbox | where {$_.recipientTypeDetails -eq 'sharedmailbox' }|Get-MailboxPermission | where {$_.user.tostring() -ne "NT AUTHORITY\SELF" -and $_.IsInherited -eq $false}

It will show you all shared mailbox permission and their users who has access to shared mailbox .

Hi

Yes you can use new-adminauditlogsearch command to find out the date and time when an exchange command was submitted and by whom. You will have to enter required parameters and commands, date & time etc to find from.

Get-help new-adminauditlogsearch for details.

Get-AdminAuditLogConfig | fl

can be used to check if admin audit logging is enabled. By default it should be for 90 days.

https://technet.microsoft.com/en-us/library/ff459243(v=exchg.141).aspx