Hi
I enabled Audit Log for the mailboxes in our organization by enabling AuditEnable value as True. However when I tried to search the log for the actions of the mailbox owner, there's no result. From the official KB, it turns out that auditing of mailbox owner actions can generate a large number of mailbox audit log entries and is therefore disabled by default.
So I enabled the auditing of mailbox owner actions by the cmdlet below. And I did move emails from the Inbox folder to the other folders and delete some emails. However still, the cmdlet search-mailboxaudit returns none. What's the real problem?
Set-Mailbox -Identity <> -AuditOwner "Move,MoveToDeletedItems,SoftDelete,HardDelete" -AuditEnabled $true
https://docs.microsoft.com/en-us/exchange/mailbox-audit-logging-exchange-2013-help
https://docs.microsoft.com/en-us/exchange/enable-or-disable-mailbox-audit-logging-for-a-mailbox-exchange-2013-help