Search-MailboxAuditLog - Category changed by ...... ?

Christian Hans
Christian Hans used Ask the Experts™
on
Would there be a way to see who changed the "category" of an email in a Shared Mailbox using the Search-MailboxAuditLog?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Top Rated Freelancer on MS Technologies
Awarded 2018
Distinguished Expert 2018
Commented:
I think that you could probably look for an "UPDATE" event on that email because the logs events are:

1.png
Here's the documentation
https://docs.microsoft.com/en-us/exchange/policy-and-compliance/mailbox-audit-logging/mailbox-audit-logging?view=exchserver-2019

https://docs.microsoft.com/en-us/powershell/module/exchange/policy-and-compliance-audit/search-mailboxauditlog?view=exchange-ps

Search-MailboxAuditLog -Identity kwok -LogonTypes Owner -ShowDetails -StartDate 1/1/2016 -EndDate 3/1/2016 | Where-Object {$_.Operation -eq "UPDATE"}

Open in new window

AkhaterSolutions Architect

Commented:
I would just like to add to what @Jose already said, be careful with enabling mailbox auditing without proper sizing, these are usually IOPS extensive operations and can drag your performance quickly down if it is not properly catered for and/or enabled for many users.

If you want to enable it only for a handful of users then don't worry about it

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial