Audit the move of email into a different folder in mailbox

TK
TK used Ask the Experts™
on
Is there a way to track how and when an email was moved to a different folder within a mailbox?

Scenario: A user received an email and disappeared when viewing on phone. When it was checked later it showed that the email was now in the user's Draft's folder. The user also has 2 delegates that have access to the mailbox and have the original user's mailbox setup on their phones as well.

Is this something that is covered within Mailbox auditing in Exchange 2010?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Rohit AnandCloud Architect

Commented:
Hi @Tk,

There is no way to track how email moved from one folder to another. However, you can enable Mailbox Auditing log to keep monitoring for such higher level users.

To Enable Auditing on Mailbox:

Set-Mailbox -Identity "MailboxEmailID" -AuditEnabled $True

As soon as auditing is enabled on a mailbox, Exchange starts to generate audit items based on the mailbox's audit configuration. You can see the configuration by running the command:
Get-Mailbox -Identity "MailboxEmailID" | Format-List Audit*

To monitor at Delegation Access, you can run below command:
Set-Mailbox -Identity "MailboxEmailID" -AuditDelegate   "Update, SoftDelete, HardDelete, SendAs, SendOnBehalf, MoveToDeletedItems, Copy"


To use the Search-MailboxAuditLog cmdlet, you'd use a command like this:

Search-MailboxAuditLog -Identity "MailboxEmailID" -LogonTypes Delegate -ShowDetails -StartDate "04/11/2019" -EndDate "06/10/2019" | ft Operation, OperationResult, LogonUserDisplayName, ItemSubject, LastAccessed, -AutoSize
If auditing enabled then you can follow the given path to export audit logs.

Exchange Admin Center > Compliance Management > Auditing > Export mailbox audit logs

Here's an article that might be of some use as well.

https://practical365.com/exchange-server/exchange-2010-mailbox-audit-logging/

https://community.spiceworks.com/how_to/124782-how-to-track-non-owner-mailbox-accesses-on-exchange-2013

Hope you find this useful.
TK

Author

Commented:
Thanks Rohit and Austin for the quick response. I had a feeling what i was looking for would not be possible especially since this action that was done took place with no mailbox auditing enabled. We have a legal mandate that we are not allowed to enable it for mailboxes.

I assume even the action of moving wouldn't be logged at all, even just the action itself?

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial