Create a mailbox audit log search
Applies to: Exchange Server 2013
You can create a mailbox audit log search to asynchronously search one or more mailboxes and have the search results sent by email as an XML file to specified addresses.
To search mailbox audit logs for a single mailbox and have the results displayed in the Shell, see Search the mailbox audit log for a mailbox.
For additional management tasks related to mailbox audit logging, see Mailbox audit logging procedures.
What do you need to know before you begin?
Estimated time to complete: 2 minutes.
You need to be assigned permissions before you can perform this procedure or procedures. To see what permissions you need, see the "Mailbox audit logging" entry in the Messaging policy and compliance permissions topic.
By default, mailbox audit logging is disabled for all mailboxes. For each mailbox you want to audit, you must enable audit logging and specify the mailbox owner, delegate, or administrator actions you want to audit. For more details, see Enable or disable mailbox audit logging for a mailbox.
You can't use the EAC to search mailbox audit logs for owner access. The auditing section in EAC includes reports for non-owner mailbox access and also allows you to search for and export non-owner access events.
For information about keyboard shortcuts that may apply to the procedures in this topic, see Keyboard shortcuts in the Exchange admin center.
What do you want to do?
Use the EAC to create a mailbox audit log search
Navigate to Compliance management > Auditing.
In the list view, select Export mailbox audit logs.
In Export Mailbox Audit Logs, complete the following fields, and then click Export:
Search these mailboxes or leave blank to find all mailboxes accessed by non-owners
Depending on the number of mailboxes in your organization and the amount of mailbox audit log data in each mailbox, searching all mailboxes may take a long time.
Search for access by
Select from the following types of access events you want to search:
Administrators and delegated users
Send the auditing report to
Use the Shell to create a mailbox audit log search
For an example of how to use the Shell to create a mailbox audit log search, see Example 1 in New-MailboxAuditLogSearch.
Send feedback about: