O'Reilly logo

Microsoft Exchange Server 2016 PowerShell Cookbook - Fourth Edition by Mike Pfeiffer, Nuno Mota, Jonas Andersson

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

How it works...

Audit information is written to the Audit subfolder of the Recoverable Items folder (known as Dumpster), which is hidden from Outlook and OWA, meaning normal users cannot access it. To determine if actions are already being audited for a mailbox, we can check if this folder has any logs by using the following cmdlet:

    Get-MailboxFolderStatistics CEO `
    -FolderScope RecoverableItems | `
    Where {$_.Name -eq "audits"} | Select ItemsInFolder  

Assuming there are already items in the folder, we can then use the Search-MailboxAuditLog cmdlet and see what actions have been captured so far. In our first example, we specified that we wanted to retrieve actions performed by delegates in the month of May, and we use the -ShowDetails switch ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required