Similar to searching the admin audit logs, there are two ways to search mailbox audit log entries using the Shell:
- By using the Search-MailboxAuditLog cmdlet to synchronously search mailbox audit log entries for a single mailbox, and displaying the search results in the Shell.
- Alternatively, you can create a mailbox audit log search to asynchronously search mailbox audit logs for one or more mailboxes, and then have the search results sent to a specified email address as an XML attachment. To create the search, you use the New-MailboxAuditLogSearch cmdlet.
In this recipe, we will see how to perform both types of searches.
