Is it possible to track which employees handled M.Exchange emails of a big company?

Question

Background: Company uses Microsoft Exchange, has several email accounts that need checking(contactus, faxes, admin, comm, etc). Several employees (over 10) check these accounts throughout the day. Once an email has been dealt with, the employee has been directed to archive the email in a respective folder (DONE, Called, etc).

Problem: Employees archiving(hiding) emails in random boxes (DONE2019) without addressing them.

Question: How can employers track compliance? I was asked to investigate if it is possible to add a "note" to the email prior to archiving it, or if there is any way to know which employee archived the email.

Reason: If employees know that actions are able to be tracked the likelihood of this issue continuing are small. (Test emails are already sent to random boxes, which is how the issue was discovered)

Than you!!!

Do above suggestions help to you? If your issue has been resolved you could mark the helpful reply as best answer and your action will be helpful to other people who encounter the same issue:) — Joy Zhang, Mar 15 '22 at 06:28

score 1 · Accepted Answer · answered Mar 10 '22 at 14:48

You will want to enable Mailbox Audit Logging on the mailbox(s) in question.

When you enable audit logging for a mailbox, you can specify which user actions (for example, accessing, moving, or deleting a message) will be logged for a logon type (administrator, delegate user, or owner). Audit log entries also include important information such as the client IP address, host name, and process or client used to access the mailbox. For items that are moved, the entry includes the name of the destination folder.

https://docs.microsoft.com/en-us/exchange/policy-and-compliance/mailbox-audit-logging/mailbox-audit-logging?view=exchserver-2019

Thank you sooo much for your help!!! – JC Forensics Mar 16 '22 at 22:03 — JC Forensics, Mar 16 '22 at 22:03

score 1 · Answer 2 · answered Mar 11 '22 at 05:36

Agree with what Appleoddity has replied above, you could enable the mailbox audit log for the specific account based on your request, then you could run search mailbox audit log to check who has modified something in the specific mailbox.

Detailed step for your reference: Search-MailboxAuditLog

Is it possible to track which employees handled M.Exchange emails of a big company?

2 Answers2