10

I read through the Technet article on Mailbox auditing but it seems to only be working for MAPI access.

I perform the following cmdlet to enable auditing of the owner:

> Set-Mailbox -Identity "Mr. Mel-Bin" -AuditEnabled $true -AuditOwner Create,SoftDelete,HardDelete,Update,Move,MoveToDeletedItems

That does not return any output. Then, I move some messages in the mailbox using IMAP client and peform the following cmdlet to see if the auditing worked:

>Search-MailboxAuditLog -Identity bfernan -LogonTypes Owner -ShowDetails -StartDate 10/9/2011

This returns no output. Is there something I am overlooking or does Exchange 2010 just not audit IMAP access?

Belmin Fernandez
  • 10,629
  • 26
  • 84
  • 145
  • You are setting the owner audit properties. Are you using the "Mr. Mel-Bin" account to log in through IMAP? – the-wabbit Oct 08 '11 at 20:29
  • @syneticon-dj yes I am. – Belmin Fernandez Oct 08 '11 at 22:34
  • Mmh. Could you add the -ShowDetails parameter to Search-MailboxAuditLog? – the-wabbit Oct 09 '11 at 09:02
  • @syneticon-dj I modified the command. This one returns no output. – Belmin Fernandez Oct 09 '11 at 15:10
  • 3
    I have no further questions, your honor. But no ideas either. It would not be the first time when certain kind of functionality is limited to MAPI acces. You might ask in the [support forum](http://social.technet.microsoft.com/Forums/en-US/exchange2010/threads) for an official statement - Microsoft employees which could simply ask the responsible product group are reading and answering there. – the-wabbit Oct 11 '11 at 07:47
  • Very well. You may step down. (Thanks @syneticon-dj! I'll ask there) – Belmin Fernandez Oct 11 '11 at 12:52
  • I've noticed using Mailbox instead of Identity works well for some PS commands, it may help in your situation if possible with the cmdlet – scape Nov 07 '12 at 18:25

1 Answers1

1
  • Is IMAP configured to report the changes back to the server? Or is it just doing the move "locally"?
  • Have you tried with e.g. OWA to see if auditing works using plain exchange?
  • You use 2 different "-Identity" strings, can you use the same for both commands?
MichelZ
  • 11,008
  • 4
  • 30
  • 58