Exchange Q&A: Exchange Administration (13)

1.What can the mailbox audit logging used for?

By using mailbox audit logging, we can log mailbox access by mailbox owners, delegates (including administrators with full access permissions to mailboxes), and administrators.

2.How to modify mailbox audit entries retention period by Exchange Management Shell?

Using the AuditLogAgeLimit parameter with the Set-Mailbox cmdlet.

3.What actions can be logged by mailbox audit logging?

  • Copy (only admin yes);
  • Create (all yes);
  • FolderBind (only owner no);
  • HardDelete (all yes);
  • MailboxLogin (only owner yes);
  • MessageBind (only admin yes);
  • Move (all yes);
  • MoveToDeletedItems (all yes);
  • SendAs (only owner no);
  • SendOnBehalf (only owner no);
  • SoftDelete (all yes);
  • Update (all yes).

4.How to search the mailbox audit log?

  • Using the cmdlet of Search-MailboxAuditLog;
  • Using the cmdlet of New-MailboxAuditLogSearch;
  • Use auditing reports in Exchange Admin Center.

5.What are the fields can be logged in a mailbox audit log entry?

  • Operation;
  • OperationResult;
  • LogonType;
  • DestFolderId;
  • DestFolderPathName;
  • FolderId;
  • FolderPathName;
  • ClientInfoString;
  • ClientIPAddress;
  • ClientMachineName;
  • ClientProcessName;
  • ClientVersion;
  • InternalLogonType;
  • MailboxOwnerUPN
  • MailboxOwnerSid
  • DestMailboxOwnerUPN;
  • DestMailboxOwnerSid;
  • DestMailboxOwnerGuid;
  • CrossMailboxOperation;
  • LogonUserDisplayName;
  • DelegateUserDisplayName;
  • LogonUserSid;
  • SourceItems;
  • ItemId;
  • ItemSubject;
  • MailboxGuid;
  • MailboxResolvedOwnerName;
  • LastAccessed;
  • Identity.

6.What is Messaging records management (MRM)?

Messaging records management (MRM) is the records management technology in Exchange Server that helps organizations manage email lifecycle and reduce the legal risks associated with email.

7.How MRM helps our organization?

  • Meet business requirements;
  • Meet legal and regulatory requirements;
  • Increase user productivity;
  • Improve storage management.

8.What are the most common MRM strategies?

  • Remove all messages after a specified period;
  • Move messages to archive mailboxes;
  • Remove messages based on folder location;
  • Allow users to classify messages;
  • Retain messages for eDiscovery purposes.

9.What are the difference journaling and archiving?

  • Journaling refers to recording email communications as part of the organization’s email retention strategy;
  • Archiving refers to removing email messages from their native location (for example, a user’s mailbox), and storing them elsewhere.

10.What are the basic components of journal rule?

  • Journal recipient: Who we want to journal;
  • Journal rule scope: What we want to journal;
  • Journaling mailbox: Where we want to store the journaled messages.

Still have questions? Click here to view Microsoft’s official documentation on Exchange.

发表评论

电子邮件地址不会被公开。 必填项已用*标注