Export Mailbox Audit Logs

You have to enable mailbox audit logging for each mailbox that you want to run a non-owner mailbox access report for. If mailbox audit logging isn't enabled for a mailbox, you won't get any results for that mailbox when you export the mailbox audit log.

You need to be assigned permissions before you can perform this procedure or procedures. To see what permissions you need, see the "Mailbox audit logging" entry in the Messaging Policy and Compliance Permissions topic.

To enable mailbox audit logging for a single mailbox, run the command in the Shell.

Set-Mailbox <Identity> -AuditEnabled $true

To enable mailbox audit logging for all user mailboxes in your organization, run the following commands.

$UserMailboxes = Get-mailbox -Filter {(RecipientTypeDetails -eq 'UserMailbox')}

$UserMailboxes | ForEach {Set-Mailbox $_.Identity -AuditEnabled $true}

When you export the mailbox audit log, Microsoft Exchange attaches the audit log, which is an XML file, to an email message. However, Outlook Web App blocks XML attachments by default. To access the exported audit log, you have to use Microsoft Outlook or configure Outlook Web App to allow XML attachments.

You need to be assigned permissions before you can perform this procedure or procedures. To see what permissions you need, see the "Outlook Web App mailbox policies" entry in the Clients and Mobile Devices Permissions topic.

Run the following command to allow XML attachments in Outlook Web App.

Set-OwaMailboxPolicy -Identity Default -AllowedFileTypes '.rpmsg','.xlsx','.xlsm','.xlsb','.tiff','.pptx','.pptm','.ppsx','.ppsm','.docx','.docm','.zip','.xls','.wmv','.wma','.wav','.vsd','.txt','.tif','.rtf','.pub','.ppt','.png','.pdf','.one','.mp3','.jpg','.gif','.doc','.bmp','.avi','.xml'

Note:
In Exchange Online, use the value OwaMailboxPolicy-Default for the Identity parameter.

To verify that you’ve successfully configured mailbox audit logging, do the following:

1. Run the following command to verify that audit logging is configured for mailboxes.
   
   Copy

   Get-Mailbox | FL Name,AuditEnabled
   

   A value of True for the AuditEnabled property verifies that audit logging is enabled.
   
2. Run the following command to verify that XML attachments are allowed in Outlook Web App for your organization.
   
   Copy

   Get-OwaMailboxPolicy | Select-Object -ExpandProperty AllowedFileTypes
   

   Verify that .xml is included in the list of allowed file types.
   

The following example shows an entry from the mailbox audit log contained in the SearchResult.xml file. Each entry is preceded by the <Event> XML tag and ends with the </Event> XML tag. This entry shows that the administrator purged the message with the subject, "Notification of litigation hold" from the Recoverable Items folder in David's mailbox on April 30, 2010.

<Event MailboxGuid="6d4fbdae-e3ae-4530-8d0b-f62a14687939" 
  Owner="PPLNSL-dom\david50001-1363917750" 
  LastAccessed="2010-04-30T11:01:55.140625-07:00" 
  Operation="HardDelete" 
  OperationResult="Succeeded" 
  LogonType="Admin"
 FolderId="0000000073098C3277988F4CB882F5B82EBF64610100A7C317F68C24304BBD18ABE1F185E79B00000026BD4F0000"
  FolderPathName="\Recoverable Items\Deletions"
  ClientInfoString="Client=OWA;Action=ViaProxy" 
  ClientIPAddress="10.196.241.168" 
  InternalLogonType="Owner"
  MailboxOwnerUPN=david@contoso.com
  MailboxOwnerSid="S-1-5-21-290112810-296651436-1966561949-1151" 
  CrossMailboxOperation="false" 
  LogonUserDN="Administrator"
  LogonUserSid="S-1-5-21-290112810-296651436-1966561949-1149">
  <SourceItems>
   <ItemId="0000000073098C3277988F4CB882F5B82EBF64610700A7C317F68C24304BBD18ABE1F185E79B00000026BD4F0000A7C317F68C24304BBD18ABE1F185E79B00000026BD540"
    Subject="Notification of litigation hold"
    FolderPathName="\Recoverable Items\Deletions" /> 
  </SourceItems>
</Event>

Watch for these fields. They can help you identify specific information about each instance of non-owner access of a mailbox.

If you can view the XML file that’s attached to the message sent by Exchange and the file contains audit log entries, then you’ve successfully configured, exported, and viewed a mailbox audit log.