Home / server / Questions / 319750
In Process
Belmin Fernandez
Asked: 2011-10-09 07:55:41 +0800 CST

How do I audit user's mailbox actions performed via IMAP in Exchange 2010?

  • 772

I read through the Technet article on Mailbox auditing but it seems to only be working for MAPI access.

I perform the following cmdlet to enable auditing of the owner:

> Set-Mailbox -Identity "Mr. Mel-Bin" -AuditEnabled $true -AuditOwner Create,SoftDelete,HardDelete,Update,Move,MoveToDeletedItems

That does not return any output. Then, I move some messages in the mailbox using IMAP client and peform the following cmdlet to see if the auditing worked:

>Search-MailboxAuditLog -Identity bfernan -LogonTypes Owner -ShowDetails -StartDate 10/9/2011

This returns no output. Is there something I am overlooking or does Exchange 2010 just not audit IMAP access?

email exchange security exchange-2010

1 Answers

    • Is IMAP configured to report the changes back to the server? Or is it just doing the move "locally"?
    • Have you tried with e.g. OWA to see if auditing works using plain exchange?
    • You use 2 different "-Identity" strings, can you use the same for both commands?
    • 1