locked
Mailbox Access Auditing in Exchange 2010 SP1 RRS feed

  • Question

  • Hello,

    I'm trying to set up mailbox access auditing for a mailbox, and I have a few question, I'll appreciate your help:

    1. What is the Admin logon-type mean? I tried to log on to a different mailbox as an administrator, but it produced got a "Delegate" logon audit record.

    2. This link says the MessageBind is supported for Admin logon only, but here it says that is also applies for delegate access. which is true?

     

    Thanks a lot,

    Sagiv

     

    Sunday, September 26, 2010 3:46 PM

Answers

All replies

  • Hi,

    I will try to help you.

    1. Admin logon-type implies audit log entries for a recipient's mailbox for actions performed by Admin

    2. MessageBind is supported for admin as well as delegate access. See the examples in this link also http://technet.microsoft.com/en-us/library/ff461937.aspx

     


    Regards from www.windowsadmin.info
    Sunday, September 26, 2010 4:02 PM
  • 1. But I did log in as admin (Exchange Admin, Domain Admin), and I still the operation's LogonType was "Delegate". What am I missing?

     

    2. Just tried it and I got an error:

    >get-mailbox | Set-Mailbox -AuditDelegate MessageBind -AuditEnabled $true

    Invalid audit operation specified. Supported audit operations for Delegate are None, Create, FolderBind, SendAs, SendOnBehalf, SoftDelete, HardDelete, Update, Move, and MoveToDeletedItems.
        + CategoryInfo          : NotSpecified: (Microsoft.Excha...asks.SetMailbox:SetMailbox) [], RecipientTaskException
        + FullyQualifiedErrorId : CC7C51C

    Sunday, September 26, 2010 4:11 PM
  • Hi,

    1. Check whether you do not have the Send As or Owner rights for the mailbox that you are trying to audit

    2. Hope the permission in 1st step will resolve the error


    Regards from www.windowsadmin.info
    Monday, September 27, 2010 2:19 PM
  • Thanks for your answer, what do you mean by "Owner" rights, on the user object in Active Directory?
    Monday, September 27, 2010 4:20 PM
  • Hi Sagiv,

    Please see David's answer in this thread:

    Exchange 2010 SP1 Mailbox Access Auditing not working

    http://social.technet.microsoft.com/Forums/en-US/exchange2010/thread/25717206-da95-41c9-8763-507a92d64153


    Frank Wang
    • Marked as answer by emma.yoyo Thursday, October 7, 2010 1:12 AM
    Wednesday, October 6, 2010 2:22 AM