Exchange 2010

I have mailbox need to know who access it and from which IP even if he is the owner of this mailbox
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

VB ITSSpecialist ConsultantCommented:
You will need to enable Mailbox Audit Logging on the mailbox that you wish to monitor. This will give you the client IP address, hostname, even the actual email client being used (e.g. Outlook, etc.) to access the mailbox. See this article for more information about Mailbox Auditing:

To enable auditing on a mailbox you simply need to run the following command in the Exchange Management Shell:
Set-Mailbox -Identity "John Doe" -AuditEnabled $True

Open in new window

To search the audit logs you can use the Search-MailboxAuditLog command. See this article for some examples, as well as the full list of parameters for this command:
Will SzymkowskiSenior Solution ArchitectCommented:
If you want true mailbox access auditing then you have to enable it. If you do not have this enabled then you will not know how had access to it, other than the users that are currently listed with Full Access.

Take a look at the below link with outlines exactly how to do this in Exchange 2010.

AlkannetworksAuthor Commented:
I have run already Set-Mailbox -Identity "user name" -AuditEnabled $True
but i need to know which command will give me from where this mailbox was opened
Big Business Goals? Which KPIs Will Help You

The most successful MSPs rely on metrics – known as key performance indicators (KPIs) – for making informed decisions that help their businesses thrive, rather than just survive. This eBook provides an overview of the most important KPIs used by top MSPs.

VB ITSSpecialist ConsultantCommented:
Then the Search-MailboxAuditLog command with the -ShowDetails switch is your friend. Please refer to this article which I posted earlier as it contains some examples along with the full list of available parameters:
AlkannetworksAuthor Commented:
I have run the command but it gives me the below error , please if u know certain command to retrieve the owner for the mailbox open the mails from where please advise

[PS] C:\Users\ibrahim.nakip\Desktop>Search-MailboxAuditLog -Identity k.nosseir -LogonTypes Owner,Delegate -StartDate 4/2/2015 -EndDate 4/5/2015 -ResultSize 2000
A valid LogonType must be specified when ShowDetails is set to false. Valid Logon Types when ShowDetails is false are:
    + CategoryInfo          : InvalidArgument: (:) [Search-MailboxAuditLog], ArgumentException
    + FullyQualifiedErrorId : 78F62C6B,Microsoft.Exchange.Management.SystemConfigurationTasks.SearchMailboxAuditLog
    + PSComputerName        : exch-db.alkancit.local
VB ITSSpecialist ConsultantCommented:
You need to include the -ShowDetails switch when specifying Owner in the -LogonTypes switch. Try re-running the same command but add -ShowDetails to the end.
AlkannetworksAuthor Commented:
I have run it but it gives me nothing as below
[PS] C:\Users\ibrahim.nakip\Desktop>Search-MailboxAuditLog -Identity k.nosseir -LogonTypes Owner,Delegate -StartDate 3/1/2015 -EndDate 5/4/2015 -ResultSize 2000 -ShowDetails
MASEE Solution Guide - Technical Dept HeadCommented:
If you want to know without commands
Try to download trial version of Exchange Reporter Plus from ManageEngine
VB ITSSpecialist ConsultantCommented:
I have run it but it gives me nothing as below
[PS] C:\Users\ibrahim.nakip\Desktop>Search-MailboxAuditLog -Identity k.nosseir -LogonTypes Owner,Delegate -StartDate 3/1/2015 -EndDate 5/4/2015 -ResultSize 2000 -ShowDetails
It will only return entries from the point in time you first enabled the Mailbox Audit Logging.

i.e. If you only turned on the audit logging on the 4th of April then there's no use trying to use a Start Date of the 1st of March as there aren't any logs prior to the 4th of April.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
AlkannetworksAuthor Commented:
many thanks
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.