Hi all,
One user account has been recently disabled. Audit logs has been enabled in our organization. Can we get the disabled mailbox user audit logs?. If yes kindly share the procedure.
We use exchange server 2016 cu19.
Regards,
Hashim
Hi all,
One user account has been recently disabled. Audit logs has been enabled in our organization. Can we get the disabled mailbox user audit logs?. If yes kindly share the procedure.
We use exchange server 2016 cu19.
Regards,
Hashim
Can we get the disabled mailbox user audit logs?
I tried a lot of tests in my Exchange 2016 but could not found any workarounds to get the audit logs of the disabled mailbox user.
As I know, Mailbox audit log records are stored in a subfolder (named Audits) in the Recoverable Items folder in each user's mailbox. However, as this document says, we can't directly access an audit log record in the Recoverable Items folder; instead, Search-MailboxAuditLog cmdlet or search the audit log is needed. So, based on all the tests results, in order to get the disabled mailbox user audit logs, we need to connect to them firstly.
By the way, what also need to be mentioned is that mailbox audit log entries are retained in the mailbox for 90 days and then deleted by default. And the disconnected mailbox is permanently deleted (purged) based on the MailboxRetention property value for the mailbox database (the default value is 30 days). Please remember to take necessary operations in time.
Hope these could help.
If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Hi @JeffYang-MSFT .
Thanks for the reply. Now if i enable that mailbox user, will i be able to get old audit logs also.
Regards,
Hashim
Hi @MohammedHashim-8426,
Thanks for your reply.
It should be able to work. I tried to re-connect to the disabled mailbox using "user01" like below and yes, I can still get its old audit logs.

Thanks for clearing it up @JeffYang-MSFT.
I have enabled the user but the audit log is disabled by default when I checked in the exchange management shell. So My query is, if I enable the audit log for that user will it consider as a new log or mount to the old audit log.
And please let me know the fastest way to get audit log report other than Exchange Admin Center.
10 people are following this question.