Are there any relevant EventIDs and or audit events registered when searching the 2007 message tracking logs via the GUI? Are there any registered when searching Powershell? I am trying to ensure service accounts are not being used inappropriately and looking for some way to audit this ability. Thanks

What do you mean about registered? ensure service accounts are not being used inappropriately and looking for some way to audit this ability Do you want to restrict the permission to use message tracking log for certain users?

James,By registered I simple mean sent to any of the event logs upon runninga search. I have a certain SVC account that alot of the helpdesk know the password too and I am not able to change it due to in house BS. I want to know when this svc acct or any other is being used to search tracking logs if possible. Thanks.

So, you want to audit the person who used the Message Tracking tool. Per my knowledge, theres no feature that can accomplish such function in the exchange 2007 natively Even if you configure the auditing on the folder of message tracking log, it can only see that the folder and files are being accessed by "NT Authority\System" and a reference to the service MSExchangeTransportLogSearch.exe The only workaround would be, enable the auditing on the folder so you know when the log files have been accessed, and then based on the time that helpdesk login to the machine having exchange management tools, it may provide certain level of auditing function. But the really proper method is, to restrict the permissions on the person who can access to those sensitive info Managing Message Tracking

Any update?

Hello valuable helpers....., First I thank to you for you have spent some time for me.. I have download the Exchange Server 2010 SP1 Web Services SDK. Currently I'm develping the Message Tracking program using Exchange server 2010 Web service(EWS). I have used the FindMessageTrackingReport(findMessageTrackReportType) method in my sample. I have added the webservice using Add Web Reference option in VB 2005 Express Edition.I have Checked the Message log enable option In Exchange server 2010 server configuration using Exchange Management Console. I didn't get any result, when I send the request then the server responses also succesful and with out any error. Always My result is, DescriptiveLinkKey 0 descriptiveLinkKeyField 0 descriptiveLinkKeyFieldSpecified False DescriptiveLinkKeySpecified False Diagnostics Nothing diagnosticsField Nothing MessageText Nothing messageTextField Nothing MessageTrackingSearchResults Nothing messageTrackingSearchResultsField Nothing MessageXml Nothing messageXmlField Nothing ResponseClass Success {0} responseClassField Success {0} ResponseCode NoError {0} responseCodeField NoError {0} responseCodeFieldSpecified True ResponseCodeSpecified True Here I am not using any filter option. Because I want to retrive all the messages and manualy I have checked whether the log file have or not. Log file also avalable in this location" C:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs" from Exchange server 2010 machine. Please I need your help. and am waitng for your replay thanks , thanks a lot for u....