Searching mailbox audit logs
Similar to searching the admin audit logs, there are two ways to search mailbox audit log entries using the Shell:
- By using the
Search-MailboxAuditLog
cmdlet to synchronously search mailbox audit log entries for a single mailbox, and displaying the search results in the Shell. - Alternatively, you can create a mailbox audit log search to asynchronously search mailbox audit logs for one or more mailboxes, and then have the search results sent to a specified email address as an XML attachment. To create the search, you use the
New-MailboxAuditLogSearch
cmdlet.
In this recipe, we will see how to perform both types of searches.
How to do it...
- To search all actions performed by delegates on the CEO's mailbox for the month of May, you use the following cmdlet:
Search-MailboxAuditLog CEO `-StartDate 05/01/2017 `-EndDate 05/31/2017 `-LogonTypes Delegate -ShowDetails
- To perform the same search asynchronously and send the results by email, you use the following cmdlet instead...