Audit Logs

Roger Roger 4,956 Reputation points
2021-01-27T12:56:11.96+00:00

Hi All

i have a user who created a folder in outlook 10 days back and suddenly it disappears today. i am using below Audit logs query but i dont see any entry when the folder is created and deleted. is the below query correct

Search-MailboxAuditLog user1@Company portal .com -LogonTypes Owner,Delegate,Admin -ShowDetails -StartDate "01/17/2021 00:00" -EndDate "01/27/2021 23:59" | Export-CSV C:\logs.csv –NoTypeInformation -Encoding utf8

Microsoft Office Online Server
Microsoft Office Online Server
Microsoft on-premises server product that runs Office Online. Previously known as Office Web Apps Server.
587 questions
Microsoft Exchange Online Management
Microsoft Exchange Online Management
Microsoft Exchange Online: A Microsoft email and calendaring hosted service.Management: The act or process of organizing, handling, directing or controlling something.
4,205 questions
Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,363 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Vasil Michev 95,836 Reputation points MVP
    2021-01-27T13:47:54.573+00:00

    The query seems OK, but auditing by default doesnt cover most Owner actions. Also, creating folders is not audited either.

    0 comments
  2. Lucas Liu-MSFT 6,161 Reputation points
    2021-01-28T02:58:43.363+00:00

    Hi @Roger Roger ,
    I agree with what michev said.
    According to Microsoft official article we could know that message or folder creation isn't audited. And when you enable mailbox audit logging for a mailbox, access to the mailbox and certain administrator and delegate actions are logged by default. To log actions taken by the mailbox owner, you must specify which owner actions should be audited. So you need specify which owner actions should be audited when you enable the mailbox audit log.
    For more information you could refer to: Mailbox audit logging in Exchange Server
    61130-1.png

    ----------

    If the response is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.