Chapter 32. Using Mailbox Audit Logging to Monitor Exchange Server

This chapter provides information and commands concerning the following topics: Enabling Mailbox Audit Logging Initiating administrative actions to test Mailbox Audit Logging Initiating a search of the mailbox audit log

In this chapter, you monitor when a delegate accesses another user’s mailbox. It is critical to monitor when someone other than the owner of the mailbox accesses it to determine whether he or she is performing appropriate and acceptable tasks on the mailbox or performing improper actions on the mailbox. This capability is much improved in Exchange 2010 SP1. For example, a CEO may ask a messaging administrator to allow her assistant to be able to send mail as the CEO. This delegation is acceptable if the CEO has approved the action. However, if the messaging administrator were to also give herself “Send As” permissions to the CEO’s mailbox, this would be unacceptable. The CEO did not indicate that she wanted the administrator to have that permission.