locked
Search-MailboxAuditLog no results for UpdateInboxRules RRS feed

  • Question

  • I am trying to find changes on UpdateInboxRules. If I do New-InboxRule or Set-InboxRule, it's not showing up in the Search-MailboxAuditLog. But for example MoveToDeletedItems is showing.

    I tried Set-Mailbox -auditadmin/auditowner/auditdelegate UpdateInboxRules but that doesn't work. I also see that it is enabled by default for Exchange Online.

    Any idea's how I can audit the changes for UpdateInboxRules?

    Thanks in advance.

    Saturday, August 10, 2019 9:26 AM

Answers

  • I got the result by specifying the logon types and choosing to show details of the log, the inbox rule was created inside the Outlook client.

    Search-MailboxAuditLog <MailboxID> -LogonTypes owner -ShowDetails | where {$_.Operation -eq "UpdateInboxRules"}

    Regards,

    Manu Meng


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    • Proposed as answer by Manu Meng Tuesday, August 13, 2019 10:06 AM
    • Marked as answer by Erjen Rijnders Tuesday, August 13, 2019 12:47 PM
    Monday, August 12, 2019 8:42 AM

All replies

  • Well, according to the Docs, this kind of change is not audited.

    If I *really* had to do this, I would probably start pulling the rules from all mailboxes on a regular basis and comparing tha latest to the previous but this, of course, is ugly and not 100% reliable.

    What is it that you are trying to achieve? Those are the users' personal mailboxes, why is it of interest to IT what rules they set on them?


    Evgenij Smirnov

    http://evgenij.smirnov.de


    Sunday, August 11, 2019 9:09 AM
  • I get no results either, I believe only changes made to rules via OWA are being audited.
    Sunday, August 11, 2019 6:56 PM
  • I got the result by specifying the logon types and choosing to show details of the log, the inbox rule was created inside the Outlook client.

    Search-MailboxAuditLog <MailboxID> -LogonTypes owner -ShowDetails | where {$_.Operation -eq "UpdateInboxRules"}

    Regards,

    Manu Meng


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    • Proposed as answer by Manu Meng Tuesday, August 13, 2019 10:06 AM
    • Marked as answer by Erjen Rijnders Tuesday, August 13, 2019 12:47 PM
    Monday, August 12, 2019 8:42 AM
  • Thanks Manu, so the answer is that only in Outlook the rule is audited. I tried via Powershell and OWA but no results.

    Tuesday, August 13, 2019 12:47 PM