How do I audit user's mailbox actions performed via IMAP in Exchange 2010?

I read through the Technet article on Mailbox auditing but it seems to only be working for MAPI access.

I perform the following cmdlet to enable auditing of the owner:

> Set-Mailbox -Identity "Mr. Mel-Bin" -AuditEnabled $true -AuditOwner Create,SoftDelete,HardDelete,Update,Move,MoveToDeletedItems

That does not return any output. Then, I move some messages in the mailbox using IMAP client and peform the following cmdlet to see if the auditing worked:

>Search-MailboxAuditLog -Identity bfernan -LogonTypes Owner -ShowDetails -StartDate 10/9/2011

This returns no output. Is there something I am overlooking or does Exchange 2010 just not audit IMAP access?


  • Is IMAP configured to report the changes back to the server? Or is it just doing the move "locally"?
  • Have you tried with e.g. OWA to see if auditing works using plain exchange?
  • You use 2 different "-Identity" strings, can you use the same for both commands?