Hello
I read this and some many more:
http://www.msexchange.org/articles_tutorials/exchange-server-2010/compliance-policies-archiving/auditing-mailbox-access.html
http://social.technet.microsoft.com/Forums/en-US/exchange2010/thread/d63a3b89-6ff1-415a-9f94-d17e9523afae
I've been searching today for two things so I wonder if you can help? I have configures my environment for this some 1-2 years ago and:
AuditEnabled is already true
AuditLogAgeLimit is 360 days
1. I want to list all "Manage Full Access Permission" changes to a certain mailbox for a certain period of time. How do I do this? This is being discussed here:
http://social.technet.microsoft.com/Forums/sa/exchange2010/thread/d63a3b89-6ff1-415a-9f94-d17e9523afae. I found some comments about possible
solutions
i. Search-AdminAuditLog -cmdlets add-mailboxpermission - this doesnt list a change I did 10 hours ago to my mailbox. I removed a test user which had full access permissions to my mailbox
And I have this which points that I have changed it
[PS] C:\Windows\system32>Search-MailboxAuditLog
RunspaceId : 236261a7-ed9e-443c-aa3d-001571190685
MailboxGuid : b59e5e1d-3301-4543-8479-4955dbfb74b9
MailboxResolvedOwnerName : X Y
LastAccessed : 9/21/2012 9:15:14 AM
Identity : contoso.com\contose users\X Y
IsValid : True
ii. Search-AdminAuditLog -StartDate 01/01/2012 -EndDate 09/20/2012 -ObjectID "contoso.com\contoso users\X Y" - this also returns nothing
2. I want to generate a full report since 1/1/2012 for my mailbox of everyone that accessed it, specifically non-owners. I know have this in ECP, and I tried and it will not generate the report because it is too big. It does work for the last 20 days or
so. It says:
"More than 1354574 results were found based on the search criteria you specified. Please narrow your search criteria."
How do I customize the report and make it work? I cannot find out how to add exceptions so I can make it smaller? I can add exceptions for one service user account (from enterprise vault) which is accessing my mailbox on a daily basis, and this generates alot
of entries. Ideally, I would select the following fields from that xml report and exclude user1 domain account,LogonUserDisplayName
or just these: LastAccessed,LogonType,ClientIPAddress,LogonUserDisplayName
Thank you
Regards,
Petro
