Search-MailboxAuditLog - Category changed by ...... ?

Christian Hans
Christian Hans used Ask the Experts™
Would there be a way to see who changed the "category" of an email in a Shared Mailbox using the Search-MailboxAuditLog?
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Top Rated Freelancer on MS Technologies
Awarded 2018
Distinguished Expert 2018
I think that you could probably look for an "UPDATE" event on that email because the logs events are:

Here's the documentation

Search-MailboxAuditLog -Identity kwok -LogonTypes Owner -ShowDetails -StartDate 1/1/2016 -EndDate 3/1/2016 | Where-Object {$_.Operation -eq "UPDATE"}

Open in new window

AkhaterSolutions Architect

I would just like to add to what @Jose already said, be careful with enabling mailbox auditing without proper sizing, these are usually IOPS extensive operations and can drag your performance quickly down if it is not properly catered for and/or enabled for many users.

If you want to enable it only for a handful of users then don't worry about it

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial