none
Log of when an email opened RRS feed

  • Question

  • Hi,

    I have a user that has received an important mail for a tender and missed the deadline because he did not see/open the email until after the deadline.

    they would like to prove that they have not read the email until when they did see it. is there a Log in exchange that logs when each email was opened? I know you can see when they receved it through the logs but can you monitor when it was opened?

    Thanks

    Sunday, October 11, 2015 10:34 PM

Answers

  • Hi,

    On server side, Mailbox audit logging will log when the message opened.

    1. Enable and configure mailbox audit logging for a mailbox.

    Set-Mailbox User1 -AuditEnabled $true -AuditOwner MessageBind

    2. Search mailbox audit logging.

    Search-MailboxAuditLog UserName -LogonTypes owner  -ShowDetails | fl operation,operationresult,LogonType,LogonUserDisplayName,ItemSubject

    More information, see this document

    https://technet.microsoft.com/en-us/library/ff459237%28v=exchg.150%29.aspx

    Best Regards.





    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com

    Lynn-Li
    TechNet Community Support

    Tuesday, October 13, 2015 7:16 AM
    Moderator
  • Hi Skaagt,

    Its not there. Anyways 'Mark as Unread' option would anyways reset it if it existed.

    Here are the available properties of a message:

    View the Internet header information for an email message

    I would recommend you to educate the user on Desktop Alert and setting up special rules on 'tender' or any important sender etc.

    Send out regular Outlook Tips and Tricks mailers.


    Regards,

    Satyajit

    Please “Vote As Helpful” if you find my contribution useful or “Mark As Answer” if it does answer your question. That will encourage me - and others - to take time out to help you.

    Monday, October 12, 2015 7:04 AM

All replies

  • Hi,

    Delivery reports and message tracking will report delivery of the email however it's not possible to determine when the email was opened unless the sender configured a read receipt when the email was sent. 

    More information on read receipts can be found here: https://support.office.com/en-nz/article/Get-delivery-and-read-receipt-confirmations-a34bf70a-4c2c-4461-b2a1-12e4a7a92141.

    If the read receipt option was not specified when the email was sent then I don't believe you will be able to prove when the email was read. 

    Thanks.


    Please mark as an answer if this answers your question

    Mark Gossa

    MCSE 2003, MCITP Enterprise Administrator 2008 R2, MCSA 2012 R2, MCTS Exchange 2010

    Blog: http://markgossa.blogspot.com

    Posts are provided “AS IS” without warranty of any kind, either expressed or implied.

    • Proposed as answer by Mark Gossa Monday, October 12, 2015 10:06 PM
    Sunday, October 11, 2015 11:28 PM
  • Hi Skaagt,

    Its not there. Anyways 'Mark as Unread' option would anyways reset it if it existed.

    Here are the available properties of a message:

    View the Internet header information for an email message

    I would recommend you to educate the user on Desktop Alert and setting up special rules on 'tender' or any important sender etc.

    Send out regular Outlook Tips and Tricks mailers.


    Regards,

    Satyajit

    Please “Vote As Helpful” if you find my contribution useful or “Mark As Answer” if it does answer your question. That will encourage me - and others - to take time out to help you.

    Monday, October 12, 2015 7:04 AM
  • Hi,

    On server side, Mailbox audit logging will log when the message opened.

    1. Enable and configure mailbox audit logging for a mailbox.

    Set-Mailbox User1 -AuditEnabled $true -AuditOwner MessageBind

    2. Search mailbox audit logging.

    Search-MailboxAuditLog UserName -LogonTypes owner  -ShowDetails | fl operation,operationresult,LogonType,LogonUserDisplayName,ItemSubject

    More information, see this document

    https://technet.microsoft.com/en-us/library/ff459237%28v=exchg.150%29.aspx

    Best Regards.





    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com

    Lynn-Li
    TechNet Community Support

    Tuesday, October 13, 2015 7:16 AM
    Moderator
  • Good point by Lynn. However only admin reading user's mailbox message is logged. And by default logging is not enabled.

    It's especially important to track access to mailboxes by users other than the mailbox owner.

    Action

    Description

    Admin

    Delegate***

    Owner

    Create

    An item is created in the mailbox. (For example, a message is   sent or received.) Note that folder creation isn't audited.

    Yes*

    Yes*

    Yes

    HardDelete

    An item is deleted permanently from the Recoverable Items   folder.

    Yes*

    Yes*

    Yes

    MailboxLogin

    The user signed in to their mailbox.

    No

    No

    Yes

    MessageBind

    An item is accessed in the reading pane or opened.

    Yes

    No

    No


    Regards,

    Satyajit

    Please“Vote As Helpful” if you find my contribution useful or “MarkAs Answer” if it does answer your question. That will encourage me - and others - to take time out to help you.


    • Edited by Satyajit321 Tuesday, October 13, 2015 7:31 AM
    Tuesday, October 13, 2015 7:30 AM
  • Hi, Satyajit321.

    I thought the action "MessageBind" cannot be logged by the Owner logontype at the beginning after reading this document, until I test it with commands above. It sounds interesting that Mailbox audit logging do actually log the action "MessageBind", though TechNet document said it cannot.

    I know the logging is not enabled by default, I just provide a possibility to track this such situation next time from server side.

    Best Regards.


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com

    Lynn-Li
    TechNet Community Support

    Tuesday, October 13, 2015 7:48 AM
    Moderator
  • One more thing I should mention, the MessageBind action will not only log an item is opened, it will also log an item is accessed in the reading pane.

    Best Regards.


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com

    Lynn-Li
    TechNet Community Support

    Tuesday, October 13, 2015 7:50 AM
    Moderator
  • Hi Lynn,

    This is interesting.

    I'm not able replicate it. Can you guide the steps performed on your side. Maybe something changed on CU10.

    [PS] C:\>Set-Mailbox SatyaTest1 -AuditEnabled $true -AuditOwner MessageBind
    Invalid audit operation specified. Supported audit operations for Mailbox Owner are None, Create, SoftDelete,
    HardDelete, Update, Move, and MoveToDeletedItems.

    Set-Mailbox article also says it doesn't work.


    Regards,

    Satyajit

    Please“Vote As Helpful” if you find my contribution useful or “MarkAs Answer” if it does answer your question. That will encourage me - and others - to take time out to help you.


    • Edited by Satyajit321 Tuesday, October 13, 2015 10:19 AM
    Tuesday, October 13, 2015 10:12 AM
  • Hi,

    Just figured it out. We can use @{Add="MessageBind"} to bypass, PowerShell's validation.

    But I'm concerned on the amount of logs it will generate if we enable it for owner's message bind.

    [PS] C:\>Set-Mailbox SatyaTest1 -AuditAdmin $true -AuditOwner @{Add="MessageBind"}
    [PS] C:\Windows\system32>get-mailbox satyatest1 | fl *audit*
    
    
    AuditEnabled     : True
    AuditLogAgeLimit : 90.00:00:00
    AuditAdmin       : {Update}
    AuditDelegate    : {Update, SoftDelete, HardDelete, SendAs, Create}
    AuditOwner       : {SoftDelete,MoveToDeletedItems,MessageBind}

    But I'm not able to retrieve the MessageBind.

    [PS] C:\>Search-MailboxAuditLog -Identity SatyaTest1 -LogonTypes Owner -ShowDetails | ft Operation*,LogonType,*Displayname
    
    Operation                      OperationResult               LogonType                     LogonUserDisplayName
    ---------                      ---------------               ---------                     --------------------
    SoftDelete                     Succeeded                     Owner                         SatyaTEST1
    MoveToDeletedItems             Succeeded                     Owner                         SatyaTEST1
    


    Regards,

    Satyajit

    Please “Vote As Helpful” if you find my contribution useful or “Mark As Answer” if it does answer your question. That will encourage me - and others - to take time out to help you.

    Tuesday, October 13, 2015 10:51 AM
  • Hi, Statyajit321

    Actually, my steps are quite simple as I post above:

    [PS] C:\Windows\system32>Set-Mailbox User1 -AuditEnabled $true -AuditOwner MessageBind
    [PS] C:\Windows\system32>Get-mailbox User1 | fl *Audit*
    
    
    AuditEnabled     : True
    AuditLogAgeLimit : 90.00:00:00
    AuditAdmin       : {Update, Move, MoveToDeletedItems, SoftDelete, HardDelete, FolderBind, SendAs, SendOnBehalf, Create}
    AuditDelegate    : {Update, SoftDelete, HardDelete, SendAs, Create}
    AuditOwner       : {MessageBind}

    Then I send a message with subject line "Test" to User1, login this user mailbox, open the "Test" message. And run Search-MailboxAuditLog to check the result (I just list two results in the command below)

    [PS] C:\Windows\system32>Search-MailboxAuditLog User1 -LogonTypes owner  -ShowDetails| fl operation,operationresult,Logo
    nType,LogonUserDisplayName,ItemSubject
    
    
    Operation            : MessageBind
    OperationResult      : Succeeded
    LogonType            : Owner
    LogonUserDisplayName : User1
    ItemSubject          : Test
    
    Operation            : MessageBind
    OperationResult      : Succeeded
    LogonType            : Owner
    LogonUserDisplayName : User1
    ItemSubject          : Test

    My exchange version is Exchange 2013 CU 10, so I agree with you that something changed in Exchange 2013 CU10.

    Best Regards.


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com

    Lynn-Li
    TechNet Community Support

    Wednesday, October 14, 2015 1:17 AM
    Moderator
  • Thanks Lynn,

    Appreciate posting the clear steps. I'll try to get hold of CU10 and come back.

    skaagt,

    Any updates on your side.


    Regards,

    Satyajit

    Please “Vote As Helpful” if you find my contribution useful or “Mark As Answer” if it does answer your question. That will encourage me - and others - to take time out to help you.

    Wednesday, October 14, 2015 8:15 AM
  • Hi Lynn,

    Adding to my previous comments, I would like to confirm that my tests are also resulting in same behavior as yours.

    MessageBind Auditing for Delegate,Owner is working for Exchange 2016 RTM as well, which has similar codes to CU10 release I suppose. Opposed to what the TechNet articles say on Admin.

    Even though the normal Set-Mailbox command still validates and shouts at you. You can use the append @{} command to add 'MessageBind', and Search-MailboxAuditLog do track it.

    TestLog below:

    [PS] C:\Windows\system32>Set-Mailbox TestUser2 -AuditDelegate "MessageBind" -AuditOwner "MessageBind"
    
    Invalid audit operation specified. Supported audit operations for Delegate are None, Create, FolderBind, SendAs,
    SendOnBehalf, SoftDelete, HardDelete, Update, Move and MoveToDeletedItems.
        + CategoryInfo          : NotSpecified: (Microsoft.Excha...asks.SetMailbox:SetMailbox) [], RecipientTaskException
        + FullyQualifiedErrorId : [Server=EX2016,RequestId=d9a15754-b219-4140-9f59-783c4c89dca0,TimeStamp=10/24/2015 3:14:
       29 PM] [FailureCategory=Cmdlet-RecipientTaskException] 7BB4441A
        + PSComputerName        : ex2016.bluehill.com
    
    [PS] C:\Windows\system32>Set-Mailbox TestUser2 -AuditDelegate @{add = "MessageBind"} -AuditOwner @{add = "MessageBind"}
    
    
    [PS] C:\Windows\system32>Search-MailboxAuditLog -Identity TestUser2 -LogonTypes Admin,Delegate,owner -ShowDetails | ft O
    peration*,LogonType,*Displayname,LastAccessed
    
    Operation               OperationResult         LogonType               LogonUserDisplayName    LastAccessed
    ---------               ---------------         ---------               --------------------    ------------
    MessageBind             Succeeded               Delegate                TestUser1               10/24/2015 8:13:37 AM
    MessageBind             Succeeded               Delegate                TestUser1               10/24/2015 8:13:35 AM
    MessageBind             Succeeded               Delegate                TestUser1               10/24/2015 8:13:35 AM
    MessageBind             Succeeded               Delegate                TestUser1               10/24/2015 8:12:51 AM
    
    
    [PS] C:\Windows\system32>Search-MailboxAuditLog -Identity TestUser2 -LogonTypes Admin,Delegate,owner -ShowDetails | ft O
    peration*,LogonType,*Displayname,LastAccessed
    
    Operation               OperationResult         LogonType               LogonUserDisplayName    LastAccessed
    ---------               ---------------         ---------               --------------------    ------------
    FolderBind              Succeeded               Owner                   TestUser2               10/24/2015 8:17:56 AM
    FolderBind              Succeeded               Owner                   TestUser2               10/24/2015 8:17:46 AM
    MessageBind             Succeeded               Owner                   TestUser2               10/24/2015 8:17:45 AM
    MessageBind             Succeeded               Delegate                TestUser1               10/24/2015 8:16:01 AM
    MessageBind             Succeeded               Delegate                TestUser1               10/24/2015 8:16:01 AM
    MessageBind             Succeeded               Delegate                TestUser1               10/24/2015 8:13:37 AM
    .......

    Correction:

    #No error generated in Ex2016, property set correctly
    Set-Mailbox TestUser2 -AuditOwner MessageBind
    
    #Only AuditDelegate with MessageBind direct gives error, similar to Ex2013,SP1 AuditOwner
    Set-Mailbox TestUser2 -AuditDelegate MessageBind

    What I think they must have opened something while fixing this.

    KB 3074823 No Send As audit events are logged when you use Send As permission in Exchange Server 2013


    Regards,

    Satyajit

    Please“Vote As Helpful” if you find my contribution useful or “MarkAs Answer” if it does answer your question. That will encourage me - and others - to take time out to help you.


    • Edited by Satyajit321 Saturday, October 24, 2015 3:36 PM
    Saturday, October 24, 2015 3:29 PM