Enabling mailbox audit logging

You can enable mailbox audit logging to track logons to mailboxes and determine which actions are being taken against a mailbox. Audit log entries for a mailbox keep track of important details such as the username, client IP address, and hostname of the computer used by the person that made the change, and the actions made, such as accessing, moving, or deleting messages. In this recipe, we'll look at what needs to be done in order to enable and configure mailbox audit logging.

How to do it...

1. To enable mailbox audit logging, use the Set-Mailbox cmdlet:

   Set-Mailbox -Identity dsmith -AuditEnabled $true
   

2. By default, audit log entries are retained per mailbox based on the AuditLogAgeLimit property, which, by default, is set to 90 days. You can increase this value using the Set-Mailbox cmdlet:

   Set-Mailbox -Identity dsmith -AuditLogAgeLimit 120
   

3. To disable mailbox audit logging, set the -AuditEnabled parameter to $false:

   Set-Mailbox -Identity dsmith -AuditEnabled $false...