How to check who accessed a shared mailbox

As any other company you may have bunch of shared mailboxes for different reasons. Some of the shared mailboxes are more important for business than others. However when multiple users have access to shared mailbox on Exchange, sometimes things can go wrong and you would like to keep eye on this shared mailbox.

Here are few lines of PowerShell to setup auditing on mailbox and pull report who accessed the shared mailbox and what has been done:

# Enable Mailbox auditing in Exchange Management Shell
Set-Mailbox –Identity “SALES” -AuditEnabled $true

To retrieve the audit log, you can run this command:

Search-MailboxAuditLog -Identity "SALES" -LogonTypes Admin,Delegate -ShowDetails -StartDate MM/DD/YYYY -EndDate MM/DD/YYYY

If you would like to send the log to specified email address for safe keeping, you can add few more things to the PowerShell line:

New-MailboxAuditLogSearch "smtp.server.name" -Mailboxes "SALES" -LogonTypes Admin,Delegate -StartDate MM/DD/YYYY -EndDate MM/DD/YYYY –ShowDetails -StatusMailRecipients Admin@YourDomain.com

Enjoy!