How to use Exchange audit logging to find out who deleted mailbox items.

In modern enterprises, mailbox security and accountability are crucial. From accidental deletions to potential misuse of sensitive data, understanding who did what in a mailbox is often a top priority for IT administrators.

Recently, I was approached by a senior executive claiming that emails from his inbox were mysteriously appearing in the Deleted Items folder. With two personal assistants managing the mailbox, there was a reasonable explanation—but it was also critical to gather proof before drawing conclusions.

The tool that comes to the rescue here is Exchange mailbox audit logging. By turning on mailbox audit logging and configuring it correctly, administrators can track actions such as email deletions, moves, and other critical events in a mailbox.

In this article, I’ll walk through how to enable audit logging, specify which actions to track, query the logs, and analyze the results—all from a real-world IT perspective.

Step 1: Understanding the Basics of Mailbox Audit Logging

Mailbox audit logging in Exchange provides detailed records of mailbox activities. Some key points to consider:

• Audit logs track user actions such as email deletion, movement, mailbox access, and folder-level operations.
• Audit scope can be restricted to certain actions, users, or mailboxes, reducing storage and processing overhead.
• Logging consumes disk space, especially in large environments, so administrators must plan carefully.
• Granular tracking allows differentiation between actions performed by the mailbox owner, delegates, or administrators.

For most investigations, you do not need to enable logging for every action. For example, if the goal is to identify who deleted emails, you can audit only delete-related actions, minimizing storage usage.

Step 2: Enabling Mailbox Audit Logging

To begin, mailbox audit logging must be enabled. This is done through Exchange Management Shell (PowerShell):

Get-Mailbox “Username” | Set-Mailbox -AuditEnabled $true

Replace "Username" with the mailbox in question.

Pro Tip: Audit logging is disabled by default on older Exchange versions. Enabling it allows tracking, but remember that logging all mailboxes organization-wide can significantly increase disk usage.

Step 3: Verify Audit Logging Status

After enabling audit logging, verify that it’s active:

Get-Mailbox “Username” | fl *audit*

This command displays audit configuration, including whether auditing is enabled and which actions are currently being logged.

Step 4: Specify Audit Actions to Track

Next, you need to specify which actions should be audited. For tracking deleted emails, you can focus on:

• SoftDelete – moves emails to the Deleted Items folder
• HardDelete – permanently deletes emails
• MoveToDeletedItems – moves items to Deleted Items via user action

Set these actions for the mailbox owner:

Set-Mailbox “Username” -AuditOwner HardDelete,SoftDelete,MoveToDeletedItems

To test this I went into this mailbox and deleted a couple of junk emails there were not needed.

Real-World Tip: If multiple delegates manage the mailbox (e.g., assistants or shared access users), consider auditing delegate actions separately with the -AuditDelegate parameter.

Step 5: Generate Test Deletions

Before pulling logs, it’s helpful to generate sample actions. For example:

1. Log in as the mailbox owner.
2. Delete a few emails you don’t need.
3. Ensure both soft deletes (Deleted Items folder) and hard deletes (Shift+Delete) are included.

This ensures the logging system captures the events accurately.

Step 6: Query the Audit Logs

Once logging is active, you can query the mailbox audit log to determine who deleted items:

Search-MailboxAuditLog -Identity “Username” -ShowDetails

This displays all logged actions. To make it more readable, filter relevant columns:

Search-MailboxAuditLog -Identity "Username" -ShowDetails | 
fl Operation*,LogonUserDisplayName,SourceItemSubject*,SourceItemFolder*

Key Columns Explained

• Operation – the action performed (e.g., SoftDelete, HardDelete)
• LogonUserDisplayName – the user who performed the action
• SourceItemSubject – subject of the affected email
• SourceItemFolder – folder where the email originated

Real-World Insight: In practice, this allows you to differentiate between actions performed by the mailbox owner versus delegates or unauthorized users.

Step 7: Analyze and Act

After filtering the logs, you can:

• Confirm which user performed the deletion
• Identify patterns of regular deletions (e.g., PAs managing the mailbox)
• Determine if any suspicious activity occurred

For ongoing investigations, consider leaving audit logging enabled for a limited duration. As mentioned, audit logs consume server resources, so always disable logging once the investigation is complete:

Set-Mailbox "Username" -AuditEnabled $false

Best Practices for Exchange Mailbox Audit Logging

1. Limit Logging Scope

Audit only the necessary actions and mailboxes. Full audit logging across all mailboxes can quickly consume storage.

2. Schedule Reports

Regularly export audit logs to a secure location for analysis, rather than querying directly from the server repeatedly.

3. Separate Owner vs Delegate Logging

Use -AuditOwner and -AuditDelegate wisely to track activities by different roles. This ensures accountability and reduces confusion in multi-user mailboxes.

4. Educate Users

Make mailbox users aware of auditing policies. Transparency increases trust and reduces accidental deletions or conflicts.

5. Monitor Storage

Audit logs are stored in the mailbox itself, which can impact mailbox quotas. Plan for disk usage, especially in environments with large mailboxes.

Real-World Experience

From my experience, audit logging rarely produces excessive data if targeted correctly. For a single mailbox, auditing only delete actions for a few days is manageable, even in medium-sized organizations.

However, attempting to enable full audit logging across all mailboxes can create:

• Storage pressure
• Performance degradation for Exchange searches
• Increased administrative overhead

The key is to balance forensic needs with system performance.

Conclusion

Exchange mailbox audit logging is a powerful tool for accountability and security. It allows IT professionals to answer critical questions such as:

• Who deleted emails from a mailbox?
• Were deletions intentional or accidental?
• Did delegates or third parties perform suspicious actions?

By enabling audit logging carefully, focusing on specific actions like deletion, and querying logs via PowerShell, IT teams can gather definitive proof and maintain operational integrity.

Final Tip: Always remember that audit logging is a temporary investigative tool—use it wisely, monitor storage impact, and disable it once your investigation concludes.

Daniel Lutton

From my early days on the helpdesk through roles as a service desk manager, systems administrator, and network engineer, I’ve spent more than 25 years in the IT world. As I transition into cyber security, my goal is to make tech a little less confusing by sharing what I’ve learned and helping others wherever I can.