How do I audit user's mailbox actions performed via IMAP in Exchange 2010?
I read through the Technet article on Mailbox auditing but it seems to only be working for MAPI access.
I perform the following cmdlet to enable auditing of the owner:
> Set-Mailbox -Identity "Mr. Mel-Bin" -AuditEnabled $true -AuditOwner Create,SoftDelete,HardDelete,Update,Move,MoveToDeletedItems
That does not return any output. Then, I move some messages in the mailbox using IMAP client and peform the following cmdlet to see if the auditing worked:
>Search-MailboxAuditLog -Identity bfernan -LogonTypes Owner -ShowDetails -StartDate 10/9/2011
This returns no output. Is there something I am overlooking or does Exchange 2010 just not audit IMAP access?
- Is IMAP configured to report the changes back to the server? Or is it just doing the move "locally"?
- Have you tried with e.g. OWA to see if auditing works using plain exchange?
- You use 2 different
"-Identity"
strings, can you use the same for both commands?