Exchange 2010

Dear
I have mailbox need to know who access it and from which IP even if he is the owner of this mailbox
thanks
AlkannetworksAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

VB ITSSpecialist ConsultantCommented:
You will need to enable Mailbox Audit Logging on the mailbox that you wish to monitor. This will give you the client IP address, hostname, even the actual email client being used (e.g. Outlook, etc.) to access the mailbox. See this article for more information about Mailbox Auditing: https://technet.microsoft.com/en-us/library/ff459237(v=exchg.141).aspx

To enable auditing on a mailbox you simply need to run the following command in the Exchange Management Shell:
Set-Mailbox -Identity "John Doe" -AuditEnabled $True

Open in new window


To search the audit logs you can use the Search-MailboxAuditLog command. See this article for some examples, as well as the full list of parameters for this command: https://technet.microsoft.com/en-us/library/ff522360(v=exchg.141).aspx
0
Will SzymkowskiSenior Solution ArchitectCommented:
If you want true mailbox access auditing then you have to enable it. If you do not have this enabled then you will not know how had access to it, other than the users that are currently listed with Full Access.

Take a look at the below link with outlines exactly how to do this in Exchange 2010.
http://www.msexchange.org/articles-tutorials/exchange-server-2010/compliance-policies-archiving/auditing-mailbox-access.html

Will.
0
AlkannetworksAuthor Commented:
Dear
I have run already Set-Mailbox -Identity "user name" -AuditEnabled $True
but i need to know which command will give me from where this mailbox was opened
0
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

VB ITSSpecialist ConsultantCommented:
Then the Search-MailboxAuditLog command with the -ShowDetails switch is your friend. Please refer to this article which I posted earlier as it contains some examples along with the full list of available parameters: https://technet.microsoft.com/en-us/library/ff522360(v=exchg.141).aspx
0
AlkannetworksAuthor Commented:
I have run the command but it gives me the below error , please if u know certain command to retrieve the owner for the mailbox open the mails from where please advise


[PS] C:\Users\ibrahim.nakip\Desktop>Search-MailboxAuditLog -Identity k.nosseir -LogonTypes Owner,Delegate -StartDate 4/2/2015 -EndDate 4/5/2015 -ResultSize 2000
A valid LogonType must be specified when ShowDetails is set to false. Valid Logon Types when ShowDetails is false are:
Admin,Delegate
    + CategoryInfo          : InvalidArgument: (:) [Search-MailboxAuditLog], ArgumentException
    + FullyQualifiedErrorId : 78F62C6B,Microsoft.Exchange.Management.SystemConfigurationTasks.SearchMailboxAuditLog
    + PSComputerName        : exch-db.alkancit.local
0
VB ITSSpecialist ConsultantCommented:
You need to include the -ShowDetails switch when specifying Owner in the -LogonTypes switch. Try re-running the same command but add -ShowDetails to the end.
0
AlkannetworksAuthor Commented:
Thanks
I have run it but it gives me nothing as below
[PS] C:\Users\ibrahim.nakip\Desktop>Search-MailboxAuditLog -Identity k.nosseir -LogonTypes Owner,Delegate -StartDate 3/1/2015 -EndDate 5/4/2015 -ResultSize 2000 -ShowDetails
0
MAS (MVE)EE Solution GuideCommented:
If you want to know without commands
Try to download trial version of Exchange Reporter Plus from ManageEngine
https://www.manageengine.com/products/exchange-reports/
0
VB ITSSpecialist ConsultantCommented:
Thanks
I have run it but it gives me nothing as below
[PS] C:\Users\ibrahim.nakip\Desktop>Search-MailboxAuditLog -Identity k.nosseir -LogonTypes Owner,Delegate -StartDate 3/1/2015 -EndDate 5/4/2015 -ResultSize 2000 -ShowDetails
It will only return entries from the point in time you first enabled the Mailbox Audit Logging.

i.e. If you only turned on the audit logging on the 4th of April then there's no use trying to use a Start Date of the 1st of March as there aren't any logs prior to the 4th of April.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
AlkannetworksAuthor Commented:
many thanks
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.