We are currently running Exchange 2010 SP1. I would like to see who has been granted full access or send as permissions on a specific mailbox, the issue is we do not have audit logging turned on this mailbox. We may have an IT employee that is snooping and we would like to stop that...

The question I have is: Is there anywhere else ( system logs, etc. ) where I can track this transaction?

  • Are you looking for an audit trail of who granted access, or just a list of people that currently have access? – Bill Sambrone Nov 19 '13 at 20:03
  • @BillSambrone I am looking for an audit trail of who was granted access over the last week – LuiCami Nov 19 '13 at 20:03

This might be kind of a pain (since audit logging is turned off), but you can review Powershell history. Since everything in Exchange 2007/2010/2013 is Powershell based, you can see where someone ran the cmdlet Add-MailboxPermission with the associated parameters. To find the log of Powershell commands, open up eventvwr.msc. Instead of looking in the usual Windows Logs area, look in Applications and Services Logs. You will see a MSExchange Management event source which has all the powershell execution history.

I just checked on my own 2010 environment and added a full mailbox permission, and it pops right up in that log.

| improve this answer | |
  • I think this will work marvelously, but just one more question. Is there anyway to filter by the user that I am auditing? – LuiCami Nov 19 '13 at 20:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.