Finding Emails from Exchange 2007 Mailbox Access Audit Log
I am attempting to find emails that are listed as being accessed in the Exchange Auditing log. The specific emails I am looking for have been saved in the mailbox, then accessed by another user. These emails have not been sent through an Exchange hub server, so they don't show up in Message Tracking logs. How can I find these messages? Will I need to use a tool such as PFDavAdmin, or can I use a PowerShell command? This is a very important issue, since we may not be able to deploy Exchange auditing if we can't do this. TIA ... Will Martin
February 3rd, 2011 12:15pm

Hi, Unfortunately, there is no way to find such messages. Also outlook is unable to search message by Message-ID. Hope this feature will be added in the next release of outlook or exchange.Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. Thanks Gen Lin-MSFT
Free Windows Admin Tool Kit Click here and download it now
February 4th, 2011 3:43am

Can PFDavAdmin or MFCMAPI pull this information out of the database? If not, what use is this message ID in this log?
February 4th, 2011 9:22am

Hi, PFDavAdmin or MFCMAPI also does not have a feature to search the message by the message-ID.Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. Thanks Gen Lin-MSFT
Free Windows Admin Tool Kit Click here and download it now
February 11th, 2011 1:30am

You don't answer my question - if I can't search the mailbox for the message ID in Outlook, MFCMAPI or PFDavAdmin, what use is the message ID without the message subject in the message audit logs? This would be more useful to me as an administrator if I had the subject, since I would then be able to export the message using Export-Mailbox. This way, I wouldn't need to open the mailbox and could still check to see what the possible improper access was.
February 14th, 2011 9:08am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics