We are running a self hosted Exchange 2016 Windows Server 2016 Datacenter.

There is a shared mailbox used by multiple users. Users have been told to mark emails in this account only in special cases, such as when a corresponding order has been fulfilled etc.

Recently, many emails had been marked as read even though those emails should have stayed unread. No user claimed to have marked them as read.

Question: Is there a way to find out which user marked those emails as unread? What about Logs?

UPDATE: I found that the AuditLogging for a defined mail account can be used to log actions in a mail account. See directions here:

I have configured the audit logging as follows:

[PS] C:\Windows\system32>Get-Mailbox [email protected] | fl *audit*

AuditEnabled     : True
AuditLogAgeLimit : 14.00:00:00
AuditAdmin       : {Update}
AuditDelegate    : {Update, Move}
AuditOwner       : {Move}

Then I moved a few mails around and marked an email as unread (using my personal outlook (as a delegate for this mail account)). Entries from the log can be fetched by:

Search-MailboxAuditLog -Identity [email protected] -LogonTypes Owner,Delegate,Admin -StartDate (Get-Date).AddHours(-1) -ShowDetails -ResultSize 2000

Problem is that there are no log entries listet corresponding to my actions (move and read/unread).


A MOVE-Action has been logged, but apparently a unread/read-Action does not get logged using my current audit log settings (the setting UPDATE seems not to log this).

Any ideas how to configure audit logging to capture the read/unread-Status-Change of an email?

  • and how can i configure Exchange in order to log a change of read/unread?
    – Thariama
    Jan 18 at 10:39
  • 1
    If you rely on users not making mistakes you're in for a rough ride. Why not provide personal mail accounts and use e.g. a distribution list, or an actual order handling system?
    – vidarlo
    Jan 18 at 11:02
  • 2
    This is not a good business process. You are re-purposing a function that designated an email as read for an internal process. Why not just change the process?
    – Greg Askew
    Jan 18 at 11:40
  • 1
    @vidarlo distribution lists are a terrible solution for scenarios like this, since no one receiving them has any visibility of what has/hasn't already been done / responded to. Jan 18 at 11:46

3 Answers 3


Is it even possible to track the change of the read/unread status?

No, there's no native feature available in Exchange to track the change of read/unread status of a mail in the shared mailbox.

As regards to the mailbox audit logs you mentioned above, as illustrated in the following table, actions like marking an item as read/unread are not logged at all: Reference: Mailbox actions logged by mailbox audit logging. enter image description here

With the above being said, for your scenario, agree with the other replies that it's not a good idea to rely on the read/unread status in the work process. Personally, I'd recommend training the users to utilize other features like flagging or categorizing an item in Outlook.

  • What about UPDATE? I mean, "An item's properties are updated" - is UNREAD/READ not a property? (well, obviously marking an email as "read" didn't trigger the logging)
    – Thariama
    Jan 19 at 8:03
  • @Thariama: doesn't make any difference, auditing wasn't enabled anyway. I doubt that auditing this particular action was ever discussed
    – Greg Askew
    Jan 19 at 10:30

Instead of focusing on how to "catch" the person who marked an email as Read, why not focus on improving the process? You've said that you can't change the process, but surely you can improve it? Why not implement a step that when an email is read and the order is processed it gets moved to a subfolder named "Processed" or "Completed"? What about creating a subfolder named "In Process" to move in process emails to? Add an additional step that the person who is working on a particular email/order sends an email to the rest of the group that they're working on order xxx? This way it can be assumed that every email in the Inbox is an unprocessed order, regardless of Read/Unread state? If it's in process or completed it's been moved to the appropriate subfolder. I can think of several ways to improve the process without needing to determine who marked an email as Read so that you can assign blame, or provide guidance to the "culprit", whichever the case may be.


Exchange doesn't have a feature that directly logs or identifies which specific user marked an email as read.

A third party tool might be able to provide it, ManageEngine Exchange Reporter Plus for example.

  • But ManageEngine Exchange Reporter Plus can only use the features of Excahnge as i could - so if they can i should be able to do it too.
    – Thariama
    Jan 19 at 8:04
  • 1
    They might have done some custom development which interfaces API's like EWS. Im not a developer so can't help with that. Maybe someone on stackoverflow can help with that
    – Turdie
    Jan 19 at 20:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .