Mailbox Auditing in Exchange 2010

Scenario: You want to audit the activity in a mailbox. Auditing includes information on who does what in a mailbox.

Enable Auditing for a mailbox: Set-Mailbox -identity "Mailbox Name" -AuditEnabled $true

Search Audit Logs for a mailbox: Search-MailboxAuditLog -Identity "Mailbox Name" -showdetails

Disable Auditing for a mailbox: Set-Mailbox -identity "Mailbox Name" -AuditEnabled $false

By default, the audit logs are retained for 90 days and then purged. This can be controlled by the -AuditLogAgeLimit parameter. The logs are stored in the mailbox under the Audits Subfolder under the Recoverable Items Folder. The Recoverable Items Folder is a hidden folder.