使用螢幕助讀程式匯出並檢閱在 Exchange 系統管理中心中的稽核記錄Use a screen reader to export and review audit logs in the Exchange admin center

您可以匯出並使用您的螢幕助讀程式中Exchange 系統管理中心 (EAC) 中Exchange Online檢閱信箱稽核記錄。如果啟用,Exchange 信箱稽核記錄資訊在信箱稽核記錄中每當使用者以外的擁有者存取信箱。每個記錄項目包括誰存取信箱的相關資訊及執行的動作。You can export and review mailbox audit logs by using your screen reader in the Exchange admin center (EAC) in Exchange Online. When enabled, Exchange mailbox auditing logs information in the mailbox audit log whenever a user other than the owner accesses the mailbox. Each log entry includes information about who accessed the mailbox and the actions performed.

本主題內容In this topic

快速入門Get started

瀏覽與 Internet Explorer 及快速鍵,並確定您擁有適當 Office 365 訂閱和系統管理角色可執行此工作。然後,開啟 EAC 並開始。Navigate with Internet Explorer and keyboard shortcuts, and make sure that you have the appropriate Office 365 subscription and admin role to perform this task. Then, open the EAC and get started.

在 EAC 中瀏覽使用瀏覽器和快速鍵Use your browser and keyboard to navigate in the EAC

Exchange Online (包括 EAC) 是以 Web 為基礎的應用程式,因此鍵盤快速鍵和導覽可能會與 Exchange 2016 中的不同。在 Exchange 系統管理中心中的協助工具Exchange Online, which includes the EAC, is a web-based application, so the keyboard shortcuts and navigation may be different from those in Exchange 2016. Accessibility in the Exchange admin center.

如果要在 Exchange Online 中於 EAC 中工作時取得最佳結果,請使用 Internet Explorer 作為您的瀏覽器。深入了解 Internet Explorer 鍵盤快速鍵For best results when working in the EAC in Exchange Online, use Internet Explorer as your browser. Learn more about Internet Explorer keyboard shortcuts.

在 EAC 中的許多工作需要使用快顯視窗,因此在您的瀏覽器中,請務必啟用 Office 365 的快顯視窗Many tasks in the EAC require the use of pop-up windows so, in your browser, be sure to enable pop-up windows for Office 365.

確認 Office 365 訂閱計劃Confirm your Office 365 subscription plan

在 Office 365 商務版和企業版的訂用計畫中,會包含 Exchange Online,但功能可能會有依計畫而異。若您的 EAC 不包含本文中所述的功能,您的訂用計畫可能不包含該功能。Exchange Online is included in Office 365 business and enterprise subscription plans, but capabilities may differ by plan. If your EAC doesn't include a function described in this article, your plan might not include it.

如需有關訂用計畫中的 Exchange Online 功能的詳細資訊,請移至我擁有那些 Office 365 商務版產品或授權?Exchange Online 服務說明For more information about the Exchange Online capabilities in your subscription plan, go to What Office 36 business product or license do I have? and Exchange Online Service Description.

開啟 EAC 中,並確認您的系統管理角色Open the EAC, and confirm your admin role

若要匯出並檢閱信箱稽核記錄、 使用螢幕助讀程式來開啟 Exchange 系統管理中心及Office 365全域系統管理員具有給您的組織管理及記錄管理系統管理員角色群組的核取。了解如何將使用螢幕助讀程式以識別您的系統管理員角色在 Exchange 系統管理中心To export and review mailbox audit logs, Use a screen reader to open the Exchange admin center and check that your Office 365 global administrator has assigned you to the Organization Management and Records Management admin role groups. Learn how to Use a screen reader to identify your admin role in the Exchange admin center.

設定信箱稽核記錄Configure mailbox audit logging

之前可以匯出,並且檢閱稽核記錄檔、 您或另一個系統管理員必須啟用信箱稽核記錄並設定Outlook允許 XML 附件。遠端 Windows PowerShell 中完成這些工作。如需詳細資訊,請前往匯出信箱稽核記錄Before you can export and review audit logs, you or another admin must enable mailbox audit logging and configure Outlook to allow XML attachments. These tasks are done in the Remote Windows PowerShell. For more information, go to Export mailbox audit logs.

匯出信箱稽核記錄Export a mailbox audit log

  1. 在 EAC 中,按 Ctrl + F6 直到主要窗格取得焦點與您聽到"儀表板,主要的導覽連結。 」In the EAC, press Ctrl+F6 until the primary navigation pane has the focus and you hear "Dashboard, Primary navigation link."

  2. 至 [規範管理] 索引標籤,並按 Enter 鍵。Tab to compliance management and press Enter.

  3. 若要將移至功能表列,按住 Ctrl + F6。To move to the menu bar, press Ctrl+F6.

  4. 為 [稽核] 索引標籤。您聽到"稽核],次要導覽連結 」。按 Enter 鍵。Tab to auditing. You hear "Auditing, Secondary navigation link." Press Enter.

  5. 若要存取主視窗清單檢視中,請按 Ctrl + F6。您聽到"稽核報告 」。To access the main window list view, press Ctrl+F6. You hear "Audit reports."

  6. 直到您聽到 「匯出信箱稽核記錄」,然後按 Enter 鍵按 Tab 鍵約六次。Press the Tab key about six times until you hear " Export mailbox audit logs," and press Enter.

  7. 這會開啟 [匯出信箱稽核記錄檔] 對話方塊中開始日期的年初下拉式方塊具有焦點,與您聽到"年度的開始日期] 下拉式方塊 」。In the Export Mailbox Audit Logs dialog box which opens, the Start date year combo box has the focus, and you hear "Year of Start date combo box."

    提示

    根據預設,開始日期是設為昨天的日期之前的兩週。啟用時,信箱稽核記錄通常為 90 天儲存項目。By default, the start date is set to two weeks before yesterday's date. When enabled, the mailbox audit log typically stores entries for 90 days.

  8. 若有必要,請輸入開始日期年份的稽核記錄。您也可以選取開始日期年份按向上鍵或向下鍵。If necessary, type the start date year for the audit logs. You can also select the start date year by pressing the Up Arrow key or the Down Arrow key.

  9. ] 索引標籤可以] 文字方塊中,並輸入或選取開始日期的月份。Tab to the month text box, and type or select the start date month.

  10. ] 索引標籤可以 * * 天 * *] 文字方塊中,與類型或選取開始日期一天。Tab to the ** day ** text box, and type or select the start date day.

  11. 結束日期年份下拉式方塊] 索引標籤。您聽到"年度結束日期下拉式方塊的"。Tab to the End date year combo box. You hear "Year of End date combo box."

    提示

    預設結束日期為今天的日期。The default end date is today's date.

  12. 若有必要,請輸入結束日期年份的稽核記錄。您也可以選取結束日期年份按向上鍵或向下鍵。If necessary, type the end date year for the audit logs. You can also select the end date year by pressing the Up Arrow key or the Down Arrow key.

  13. ] 索引標籤可以] 文字方塊中,並輸入或選取 [結束日期的月份。Tab to the month text box, and type or select the end date month.

  14. ] 索引標籤可以] 文字方塊中,並輸入或選取結束日期一天。Tab to the day text box, and type or select the end date day.

  15. 若要存取 [選取使用者] 按鈕,請按兩次按 Tab 鍵。您聽到 「 搜尋這些信箱或保留空白以尋找非擁有者所存取的所有信箱 」。To access the select users button, press the Tab key twice. You hear "Search these mailboxes or leave blank to find all mailboxes accessed by non-owners."

    提示

    如果您想要匯出的所有信箱的稽核記錄,未選取任何使用者,以及移至步驟 10。當搜尋這些使用者] 方塊是空白的時搜尋會包含所有的信箱。If you want to export audit logs for all mailboxes, don't select any users, and go on to step 10. When the Search these users box is blank, the search includes all mailboxes.

  16. 若要開啟 [選取信箱] 對話方塊中,具有焦點的 [選取使用者] 按鈕上,按 Enter 鍵。* * 搜尋 * ] 方塊中具有焦點,且您聽到"篩選或編輯搜尋"。輸入全部或部分名稱的第一個信箱的稽核記錄您要匯出,搜尋名稱] 中,按下 Enter。To open the **Select Mailbox* dialog box, with the focus on the select users button, press Enter. The ** Search ** box has the focus, and you hear "Filter or search edit." Type all or part of the name of the first mailbox whose audit logs you want to export and then, to search for the name, press Enter.

  17. 若要選取的信箱,請按 Tab 鍵四次直到您聽到的搜尋結果清單中的信箱擁有者名稱。如果在搜尋結果清單中有多個信箱、 按向下鍵或向上鍵,直到您聽到信箱擁有者的名稱。To select a mailbox, press the Tab key four times until you hear the name of the mailbox owner in the search results list. If there are multiple mailboxes in the search results list, press the Down Arrow or Up Arrow key until you hear the name of the mailbox owner.

    提示

    您可以選取多個連續的信箱。若要使用的所有信箱,保留在搜尋方塊空白的或輸入全部或部分您想要新增的信箱名稱。] 索引標籤可以在搜尋結果。按向下鍵聽到每個名稱。若要新增將其全部,請按 Ctrl + A。若要新增列連續的數個信箱,請按向下鍵或向上鍵直到您聽到您想要新增、 按住 Shift 鍵,直到您聽到您想要新增的最後一個信箱名稱按向下鍵或向上鍵的第一個信箱名稱然後再放開 Shift 鍵。會選取第一個及最後一個信箱名稱之間的所有信箱。You can select multiple consecutive mailboxes. To work with all mailboxes, leave the Search box blank, or enter all or part of the mailbox names you want to add. Tab to the search results. Press the Down Arrow key to hear each name. To add them all, press Ctrl+A. To add several mailboxes listed consecutively, press the Down Arrow key or the Up Arrow key until you hear the first mailbox name you want to add, hold down the Shift key, press the Down Arrow key or the Up Arrow key until you hear the last mailbox name you want to add, and then release the Shift key. All mailboxes between the first and last mailbox names are selected.

  18. 若要新增清單中要包含在稽核記錄檔匯出選取的信箱,請按 Enter 鍵。信箱清單會保留在焦點,以便您可以繼續加以選取並按 Enter 鍵來新增多個信箱。To add the selected mailbox(es) to the list to be included in the audit log export, press Enter. The list of mailboxes retains the focus, so you can continue to add more mailboxes by selecting them and pressing Enter.

    提示

    若要查看已新增信箱] 索引標籤至 [新增] 按鈕。若要聽到信箱的清單,請再次按 Tab 鍵。您聽到清單中的第一個信箱名稱。若要聽到第二個信箱名稱清單中的,按 Tab 鍵一個更多時間。繼續按 Tab 鍵直到您聽到已新增的所有信箱的名稱。若要從清單中刪除信箱,啟動 [移除] 連結時聽到信箱名稱按下 enter 鍵。To check the mailboxes you've added, tab to the Add button. To hear the list of mailboxes, press the Tab key again. You hear the first mailbox name in the list. To hear the second mailbox name in the list, press the Tab key one more time. Continue pressing the Tab key until you hear the names of all the mailboxes you've added. To delete a mailbox from the list, activate the Remove link by pressing Enter when you hear the mailbox name.

  19. 若要搜尋其他信箱或一組信箱] 索引標籤好幾次直到您聽到"篩選或編輯搜尋"。輸入全部或部分您想要新增,並按 Enter 鍵的下一個信箱的名稱。重複步驟 b 與 c。針對您想要新增的所有信箱執行此動作。To search for another mailbox or set of mailboxes, tab several times until you hear "Filter or search edit." Type all or part of the name of the next mailboxes you want to add, and press Enter. Repeat steps b and c. Do this for all mailboxes you want to add.

  20. 若要新增外部信箱,請按 Tab 鍵直到您聽到"] 核取名稱編輯、 以文字輸入。 」(在 [朗讀程式],您聽到 「 編輯 」。)輸入外部收件者的電子郵件地址按 Shift + Tab 鍵來選取 * * 檢查名稱 * *] 按鈕,並按 Enter。這會驗證電子郵件地址並將其新增到信箱的清單。To add an external mailbox, press the Tab key until you hear "Check names edit, Type in text." (In Narrator, you hear "Editing.") Type the email address of the external recipient, press Shift+Tab to select the ** Check names ** button, and then press Enter. This verifies the email address and adds it to the list of mailboxes.

    提示

    請注意如果您輸入的外部電子郵件地址並按 Enter 鍵,此位址新增至清單,然後關閉對話方塊。如果您未完成作業後,使用 [檢查名稱] 按鈕將改用。Be aware that if you type an external email address and press Enter, this adds the address to the list and then closes the dialog box. If you're not finished, use the Check names button to add it instead.

  21. 當您完成新增信箱] 索引標籤的 [確定] 按鈕以並按 Enter 鍵。匯出信箱稽核記錄檔] 對話方塊具有焦點,並搜尋這些信箱] 文字方塊中列出所選的信箱。When you finish adding mailboxes, tab to the OK button and press Enter. The Export Mailbox Audit Logs dialog box has the focus again, and the Search these mailboxes text box lists the selected mailboxes.

  22. 若要搜尋的存取下拉式方塊] 索引標籤。這會指定您想要顯示的稽核記錄檔的哪些類型的信箱非擁有者。Tab to the Search for access by combo box. This specifies which types of mailbox non-owners you want the audit logs to show.

    • 若要讓稽核記錄未顯示所有非擁有者,您不需要執行任何動作,因為這是預設。To have the audit logs show all non-owners, you don't need to do anything, as this is the default.

    • 若要指定非擁有者,例如外部使用者(Microsoft 資料中心系統管理員)、系統管理員和委派的使用者,或系統管理員,群按向下鍵以移至您要使用者類型,然後按輸入。To specify a certain group of non-owners, like External users (Microsoft datacenter administrators), Administrators and delegated users, or Administrators, press the Down Arrow key to move to the user type you want, and then press Enter.

  23. 按 Tab 鍵按兩次來存取下的 [選取使用者] 按鈕。您聽到"選擇器] 按鈕來傳送稽核報告 」。若要開啟 [選取成員] 對話方塊,請按 Enter 鍵。* * 搜尋 * * 按鈕都不具有焦點。Press the Tab key twice to access the next select users button. You hear "Send the audit report to picker button." To open the Select Members dialog box, press Enter. The ** Search ** button has the focus.

  24. 若要搜尋組織內的使用者,請按 Enter,輸入全部或部分名稱的第一個稽核記錄檔收件者,並按下 Enter。To search for a user within your organization, press Enter, type all or part of the name of the first audit log recipient, and then press Enter.

  25. 按 Tab 鍵好幾次直到您聽到的搜尋結果清單中的使用者名稱。Press the Tab key several times until you hear the name of the user in the search results list.

  26. 將使用者新增至的稽核記錄檔的收件者清單,請按向下鍵直到您聽到的使用者名稱,然後按 Enter。使用者清單會保留焦點,以便您可以繼續新增多個收件者選取其信箱並按下 enter 鍵。To add the user to the list of audit log recipients, press the Down Arrow key until you hear the user's name, and then press Enter. The list of users retains the focus, so you can continue to add more recipients by selecting their mailboxes and pressing Enter.

    提示

    若要查看已新增的收件者] 索引標籤至 [新增] 按鈕。若要聽到的收件者清單,請再次按 Tab 鍵。名字是唯讀的。若要聽到清單中的第二個名稱,請按 Tab 鍵一個更多時間。繼續按 Tab 鍵直到您聽到已新增的所有收件者的名稱。若要從清單中刪除收件者,啟動 [移除] 連結當您聽到的使用者名稱時按下 enter 鍵。To check the recipients you've added, tab to the Add button. To hear the list of recipients, press the Tab key again. The first name is read. To hear the second name in the list, press the Tab key one more time. Continue pressing the Tab key until you hear the names of all the recipients you've added. To delete a recipient from the list, activate the Remove link by pressing Enter when you hear the user name.

  27. 若要搜尋其他名稱或一組中組織內的名稱、 索引標籤好幾次直到您聽到 「 Filter 或搜尋編輯 」。輸入全部或部分的下一個您想要新增,並按 Enter 鍵的使用者名稱。重複步驟 b 與 c。這麼做的所有稽核報告收件者在組織中。To search for another name or set of names from within your organization, tab several times until you hear "Filter or search edit." Type all or part of the name of the next user you want to add, and press Enter. Repeat steps b and c. Do this for all audit report recipients in your organization.

  28. 若要新增的外部收件者,請按 Tab 鍵直到您聽到 「 檢查名稱編輯類型中的文字 」。(在 [朗讀程式],您聽到 「 編輯 」。)輸入外部收件者的電子郵件地址按 Shift + Tab 鍵來選取 [檢查名稱] 按鈕,然後按下 Enter。此驗證電子郵件地址並將其新增至 [收件者] 清單。To add an external recipient, press the Tab key until you hear "Check names edit, Type in text." (In Narrator, you hear "Editing.") Type the email address of the external recipient, press Shift+Tab to select the Check names button, and then press Enter. This verified the email address and adds it to the list of recipients.

    提示

    請注意如果您輸入的外部電子郵件地址並按 Enter 鍵,這將收件者新增至清單,然後關閉對話方塊。如果您未完成作業後,使用 [檢查名稱] 按鈕將改用。Be aware that if you type an external email address and press Enter, this adds the recipient to the list and then closes the dialog box. If you're not finished, use the Check names button to add it instead.

  29. 當您完成新增使用者] 索引標籤的 [確定] 按鈕以並按 Enter 鍵。匯出信箱稽核記錄檔] 對話方塊具有焦點,並傳送稽核報告給] 文字方塊中列出的稽核記錄檔收件者。When you finish adding users, tab to the OK button and press Enter. The Export Mailbox Audit Logs dialog box has the focus again, and the Send the audit report to text box lists the audit log recipients.

  30. ] 索引標籤可以 * * 匯出 * *] 按鈕,然後按 Enter。Exchange 擷取信箱稽核記錄中符合搜尋準則的項目、 將它們儲存到名為 SearchResult.xml、 csv 檔案,然後將 XML 檔案附加到 24 小時內傳送至您所選的稽核記錄檔收件者的電子郵件。Tab to the ** export ** button and press Enter. Exchange retrieves entries in the mailbox audit log that meet your search criteria, saves them to a file named SearchResult.xml, and then attaches the XML file to an email message sent within 24 hours to your selected audit log recipients.

    提示

    如果您聽到錯誤訊息表示找不到您嘗試開啟的項目,檢查所選取的信箱已啟用稽核記錄。也會檢查範圍內所選取的日期。日期必須晚於已啟用稽核記錄,並依預設,在過去 90 天內。If you hear an error message that says the items you're trying to open couldn't be found, check that audit logging is enabled for the selected mailboxes. Also check that the selected dates are within range. The dates need to be after the date audit logging was enabled, and, by default, within the past 90 days.

檢閱信箱稽核記錄Review a mailbox audit log

  1. 開啟Outlook並登入您的信箱 (或信箱稽核記錄傳送的位置)。Open Outlook and sign in to your mailbox (or the mailbox where the audit log was sent).

  2. 在收件匣,尋找並開啟包括 「 信箱稽核記錄搜尋 」 及 XML 檔案附件名為 SearchResult.xml 主旨 Exchange 或Outlook所傳送的郵件。電子郵件訊息本文包含此匯出的稽核記錄檔的搜尋準則。In the Inbox, find and open the message sent by Exchange or Outlook with a subject including "Mailbox Audit Log Search" and an XML file attachment named SearchResult.xml. The body of the email message contains the search criteria for this exported audit log.

    提示

    如果Outlook未設定成允許 XML 附件,您可能會收到電子郵件訊息,但無法開啟 XML 附件。此外,如果您找不到郵件,您可能需要再等候。收件者通常接收匯出的稽核記錄 24 小時內,但在某些情況下可能需要幾天。If Outlook is not configured to allow XML attachments, you might receive the email message but not be able to open the XML attachment. Also, if you can't find the message, you might need to wait longer. Recipients typically receive the exported audit log within 24 hours, but in some cases it might take a few days.

  3. 選取 [郵件附件之後,並指定您想要下載 XML 檔案。Select the message attachment and specify that you want to download the XML file.

  4. 在 Excel 中開啟 SearchResult.xml 檔案。每個記錄項目包含關於非擁有者存取信箱之信箱的資訊和動作執行。下列欄位都包含在內,與其他人,稽核記錄檔中:Open the SearchResult.xml file in Excel. Each log entry includes information about non-owners of the mailbox who accessed the mailbox and the actions performed. The following fields are included, among others, in the audit log:

此信箱稽核記錄 」 欄位This mailbox audit log field 讓此資訊Gives this information
擁有者Owner
非擁有者存取信箱的擁有者The owner of the mailbox accessed by a non-owner
LastAccessedLastAccessed
日期和時間的最新的信箱存取The date and time of the most recent mailbox access
作業Operation
非擁有者所執行的動作The action performed by the non-owner
OperationResultOperationResult
非擁有者所執行的動作成功還是失敗Whether the action performed by the non-owner succeeded or failed
LogonTypeLogonType
非擁有者存取,例如系統管理員、 委派、 或外部 Microsoft 資料中心系統管理員的類型The type of non-owner access, like administrator, delegate, or external Microsoft datacenter administrator
ClientIPAddressClientIPAddress
使用非擁有者存取信箱之電腦的 IP 位址The IP address of the computer used by the non-owner to access the mailbox
LogonUserDNLogonUserDN
非擁有者的顯示名稱The display name of the non-owner
主旨Subject
受到非擁有者的郵件主旨行The subject line of the message affected by the non-owner