Mailbox Auditing Explained

What is mailbox audit logging?

Mailbox audit logging is used for tracking logons to a specific mailbox as well as actions and changes that are made during the session.  It can also be used to track ‘Send As,’ ‘SendOnBehalfOf,’  creations, deletions, etc.

This logging can generate many logs which can consume a good amount of space, and is thus disabled by default.

Enabling mailbox audit logging on a mailbox

Example cmdlet to enable:

Set-Mailbox -Identity "JoshTest" -AuditEnabled $true

In order to perform mailbox audit logging, you need to be a member of a role group with the “Audit Logs” role assigned to it.  Two default role groups that have this functionality are:

• Organization Management
• Records Management

You can create custom role groups as well; reference the ‘RBAC Explained’ article.

Enabling auditing will automatically include administrator and delegate actions by default, while omitting actions made by the mailbox owner.

Searching mailbox audit logs

There are three ways to search mailbox audit logs: Synchronous, Asynchronous, GUI (via ECP).

Example Type: 

Synchronous.

Task Description:                            

Perform a synchronous mailbox audit log search with the goal of finding all audit log entries for JoshTest’s mailbox regarding admin/delegate actions in the time frame of 2/20/2011 – 2/25/2011, and display the results in the powershell window.

Cmdlet Example:        

    

Search-MailboxAuditLog -Identity JoshTest -LogonTypes Admin,Delegate -StartDate 2/20/2011 -EndDate 2/25/2011

Full Syntax Considerations:       

http://technet.microsoft.com/en-us/library/ff522360.aspx

Example Type:                 

Asynchronous.

Task:                                    

Perform an asynchronous mailbox audit log search with the goal of finding all audit log entries for JoshTest's mailbox regarding delegate actions in the time frame of 2/20/2011 – 2/25/2011, and populate an XML file with the results to be delivered via e-mail upon completion.

Cmdlet Example:                            

New-MailboxAuditLogSearch "Delegate Actions on JoshTest" -Mailboxes "JoshTest" -LogonTypes Delegate -StartDate 3/1/2011 –EndDate 3/1/2011 -StatusMailRecipients Mailbox.Auditor@azaleos.com

Full Syntax Considerations:       

http://technet.microsoft.com/en-us/library/ff522362.aspx

Example Type:                 

GUI / ECP

Task:                    

Perform a mailbox audit log search via the ECP with the goal of finding all audit log entries for a user regarding administrative actions on 3/1/2011, and populate an XML file with the results to be delivered via e-mail upon completion.

Steps:

Log in as an admin account (see prior requirements) to the ECP, or to OWA and enter the ECP via the Options section.

Navigate to ‘Roles and Auditing’ and then ‘Auditing.’

Export mailbox audit logs:

Fill out the criteria for the user to search, the scope, and who to send the report to:

In time, you will receive the output in XML format at the e-mail address specified:

Full Considerations:      

http://help.outlook.com/en-us/beta/37618aac-bd50-4322-9054-502461690ed9.aspx?sl=1

Interpreting the mailbox audit log

Example:

MailboxGuid="1a5348dc-2bdd-4606-9d22-59005ca2eb7c" 

Owner="AVictim" 

LastAccessed="2011-03-01T22:42:41.0772536-07:00" 

Operation="SendAs"

ItemId="RgAAAADH7DJI8nRmW9d7HDLIvGH+JsErT8IbDiflR6zCD/BEMJIcAAAA4j5cAABaE7PuVtsyT6zCD/BEMJIcAAAA4pUbAAAJ" 

ItemSubject="You're fired!" 

OperationResult="Succeeded" 

LogonType="Delegate" 

ClientInfoString="Client=OWA" 

ClientIPAddress="10.10.15.15" 

InternalLogonType="Owner" 

MailboxOwnerUPN="AVictim@raymond.com" 

MailboxOwnerSid="S-1-5-21-1542865472-92671928-526660263-5723"

LogonUserDisplayName="A. Badman" 

LogonUserSid="S-1-5-21-1542865472-92671928-526660263-3722"

OriginatingServer="EXCHANGE01 (14.01.0218.011)"

MailboxGuid="1a5348dc-2bdd-4606-9d22-59005ca2eb7c" 

Owner=" AVictim" 

LastAccessed="2011-03-01T22:42:41.061631-07:00"

Operation="Create" 

ItemId="RgAAAADH7DJI8nRmW9d7HDLIvGH+JsErT8IbDiflR6zCD/BEMJIcAAAA4j5cAABaE7PuVtsyT6zCD/BEMJIcAAAA4pUbAAAJ" 

ItemSubject="You're fired!" 

OperationResult="Succeeded" 

LogonType="Delegate" 

FolderId="LgAAAABN9DVF1dUmR6o4DOZQiD9+AQBaE7PuVtsyT6zCD/BEMJIcAAAA4j5cAAAB" FolderPathName="\Drafts" 

ClientInfoString="Client=OWA" 

ClientIPAddress="10.10.15.15" 

InternalLogonType="Owner" 

MailboxOwnerUPN=" AVictim@raymond.com" 

MailboxOwnerSid="S-1-5-21-1542865472-92671928-526660263-5723" 

LogonUserDisplayName="A. Badman" 

LogonUserSid="S-1-5-21-1542865472-92671928-526660263-3722" 

OriginatingServer="EXCHANGE01 (14.01.0218.011)

Judging by this output, it looks like A. Badman has logged on successfully, created the original draft, and sent an e-mail as (Send As) A. Victim via OWA at 22:42:41 on 3/1/2011.  It also looks like the e-mail wasn’t work appropriate with a subject like that!
 

MailboxGuid="1a5348dc-2bdd-4606-9d22-59005ca2eb7c" 

Owner=" AVictim"

LastAccessed="2011-03-01T23:18:51.2507346-07:00" 

Operation="HardDelete" 

OperationResult="Succeeded" 

LogonType="Delegate" 

FolderId="LgAAAABN9DVF1dUmR6o4DOZQiD9+AQBaE7PuVtsyT6zCD/BEMJIcAAAA4j5RAAAB" 

FolderPathName="\Inbox" 

ClientInfoString="Client=MSExchangeRPC" 

ClientIPAddress="10.10.15.15" 

ClientProcessName="OUTLOOK.EXE" 

ClientVersion="12.0.6550.5000" 

InternalLogonType="Owner" 

MailboxOwnerUPN="AVictim@raymond.com" 

MailboxOwnerSid="S-1-5-21-1542865472-92671928-526660263-5723" 

CrossMailboxOperation="false" 

LogonUserDisplayName="A. Badman" 

LogonUserSid="S-1-5-21-1542865472-92671928-526660263-3722" 

OriginatingServer="EXCHANGE01 (14.01.0218.011)"

It would also appear that A. Badman has been busy deleting items from the mailbox as well.  You can see from the log that this was done via Outlook 2007.

A quick-hit list of the important fields:

Field	Description
Owner	The owner of the mailbox that was accessed by a non-owner.
LastAccessed	The date and time when the mailbox was accessed.
Operation	The action that was performed by the non-owner. For more information, see the " What gets logged in the mailbox audit log?" section in Run a Non-Owner Mailbox Access Report
OperationResult	Whether the action performed by the non-owner succeeded or failed.
LogonType	The type of non-owner access. These include administrator, delegate, and external.
FolderPathName	The name of the folder that contained the message that was affected by the non-owner.
ClientInfoString	Information about the mail client used by the non-owner to access the mailbox.
ClientIPAddress	The IP address of the computer used by the non-owner to access the mailbox.
InternalLogonType	The logon type of the account used by the non-owner to access this mailbox.
MailboxOwnerUPN	The e-mail address of the mailbox owner.
LogonUserDN	The display name of the non-owner.
Subject	The subject line of the e-mail message that was affected by the non-owner.

Table originally pulled from outlook help link located here.

The full field list is here:

http://technet.microsoft.com/en-us/library/ff459237.aspx#Mailbox

The properties on have invalid data. If you click OK, default values will be used..

A customer had a user with a mailbox throwing the following error whenever they tried to change a value:

The properties on [recipient] have invalid data. If you click OK, default values will be used instead and will be saved if you do not change them before hitting Apply or OK on the property page. If you click cancel, the object will be displayed read-only and corrupted values will be retained.

OK no problem, I'll just go in and get rid of anything that doesn't look right...wrong. The console wouldn't let me save the settings.

Apparently the storage quotas were such that the Prohibit Send Limit value was less than the Warning Limit. I was, however, unable to modify it in ADUC/DSA or in the EMC.

I attempted to change the value in EMS, but it threw the exact same error.

When finesse isn't enough, brute force wins. I popped open adsiedit.msc by launching adsiedit.msc from 'Run,' then navigated to where the user resided under Domain -> User OU, right clicked, and clicked properties. Sure enough the EMC and EMS were lying to me:

I modified the values to what I wanted them to be:

Voila.. Invalid Data errors are gone.

Deleting a Message From Everyone's Mailbox

Need to delete a message from everyone's mailbox at the server level?  Here is the command for you:

Get-Mailbox | Export-mailbox -SubjectKeywords "FillintheSubject" -StartDate "03/04/09" -EndDate "03/04/09" -TargetMailbox "Admin" -TargetFolder "Inbox" –DeleteContent

You can also add -ContentKeywords for additional filtering.