Audit information is written to the Audit subfolder of the Recoverable Items folder (known as Dumpster), which is hidden from Outlook and OWA, meaning normal users cannot access it. To determine if actions are already being audited for a mailbox, we can check if this folder has any logs by using the following cmdlet:
Get-MailboxFolderStatistics CEO `
-FolderScope RecoverableItems | `
Where {$_.Name -eq "audits"} | Select ItemsInFolder
Assuming there are already items in the folder, we can then use the Search-MailboxAuditLog cmdlet and see what actions have been captured so far. In our first example, we specified that we wanted to retrieve actions performed by delegates in the month of May, and we use the -ShowDetails switch ...
