After you've enabled mailbox audit logging, there are two ways from within the Exchange Management Shell that you can search for the logs and generate reports. In this recipe, you'll learn how to use both synchronous and asynchronous mailbox audit log searches from the Exchange Management Shell.
Search-MailboxAuditLogcmdlet. After executing the following command, the results will be displayed in the shell:
Search-MailboxAuditLog -Identity dsmith -ShowDetails
New-MailboxAuditLogSearch -Name Search1 ` -Mailboxes dsmith,bjones ` -LogonTypes admin,delegate ` -StartDate ...