No announcement yet.

Exchange mailbox access auditing

  • Filter
  • Time
  • Show
Clear All
new posts

  • Exchange mailbox access auditing

    I have seen various ways of getting statistics from exchange logins but nothing with all the information I am looking for. I need to be able to see details of all logins to a particular mailbox in a given date range.
    (Note: need to be able to see owner access as well, to identify if someone else logged in with the owner's password)

    Specifically I want to input: mailbox name, start date, end date.

    I want to see a table that shows the following columns:
    -Login date
    -Login IP address
    -Login MAC address
    -Client type (OWA, outlook, OMA, etc...)
    -Access type (owner, delegate, administrator)
    -Access username (name of owner or delegate)

    What is the easiest way of doing this? I am using Exchange 2010.
    Is there a tool in the market that already does this?
    Last edited by foosy11; 16th October 2013, 14:52.

  • #2
    Re: Exchange mailbox access auditing

    Exchange 2010 has Mailbox Auditing. See this article: Understanding Mailbox Audit Logging

    I've checked, the only thing not on the list is MAC address. That's also the least interesting information IMHO. As for date range, auditing has to be enabled before this information is logged. You can't find specific enabled information before auditing. It also has to enabled per mailbox so it's something to enable during user provisioning.
    Last edited by dmstork; 16th October 2013, 18:36. Reason: Extra clarification