Return
-
Title
How to identify shared mailboxes in Exchange Mailbox auditing? -
Description
How to identify shared mailboxes and audit them? -
Cause
Shared mailbox events will only be generated when both of the following conditions exist:• The affected mailbox is selected for auditing (i.e., added to the Exchange Mailbox Auditing list on theAdministration Tasks tab).• The mailbox is either located in an Exchange 2007 SP1 (or higher) mailbox store or has been marked as ashared mailbox by the user. -
Resolution
To view list of Shared Mailboxes in auditing list:Automatic shared mailbox detection locates Exchange 2007 SP1 (or higher) shared mail, equipment and roommailboxes in the network.1 Open the Administration Tasks tab.2 Click the Auditing task button at the bottom of the navigation pane (left-hand pane).3 Select Exchange Mailboxes under the Applications heading in the Auditing task list.The Exchange Mailbox Auditing page appears.4 At the top of the Exchange Mailbox Auditing page, click the Shared Mailboxes tool bar button.5 If not already displayed, open the Auto Detected page.The Auto Detected page displays a read-only list of the shared mailboxes detected in the network.The Filter Shared Mailboxes Based on Exchange Auditing Scope check box is selected by default andonly shared mailboxes that are selected for auditing are displayed. To display all shared mailboxesdetected in the network, clear this check box.6 Click Close to close the dialog and return to the Exchange Mailbox Auditing page.To convert one or more mailboxes to a Shared Mailbox under Exchange follow the TechNet article to add 'shared' mailboxes to the Auto Detected list: https://technet.microsoft.com/en-us/library/jj710164(v=exchg.150).aspxOrTo manually add mailboxes to shared mailbox list:Any mailbox can be marked as a shared mailbox by manually adding it to the shared mailbox list. This is usefulfor correctly monitoring mailboxes imported from Exchange 2003 (or earlier) that were used as sharedmailboxes but have not been converted to Exchange 2007 shared mailboxes.1 Open the Administration Tasks tab.2 Click the Auditing task button at the bottom of the navigation pane (left-hand pane).3 Select Exchange Mailboxes under the Applications heading in the Auditing task list.The Exchange Mailbox Auditing page appears.4 At the top of the Exchange Mailbox Auditing page, click the Shared Mailboxes tool bar button.5 Open the User Defined page on the Shared Mailboxes dialog.6 Click the Add button at the bottom of this page.7 On the Exchange Shared Mailboxes dialog, use the Browse and Search pages to locate and select adirectory object (i.e., User, Group, Container, DomainDNS, OrganizationalUnit, or BuiltinDomain) andclick the Add button to add the selected object to the Selected Object list at the bottom of the page.Repeat this step to add additional directory objects to the Exchange Shared Mailbox list.8 Click the Finish button to close this dialog and return to the Shared Mailboxes dialog, where yourselections will now be listed on the User Defined page of this dialog.9 The default scope of coverage is displayed in the Scope cell. You can change this by placing your cursorin the Scope cell, clicking the arrow control and selecting the appropriate option from the list:• Object - to audit an individual object• One Level - to audit an object and its direct child objects• Subtree - to audit an object all of its subordinate objects (all levels)10 The Status field on this page indicates the type of events that are to be generated for the mailbox:• Enabled (default) - shared mailbox events are to be generated for the mailbox• Disabled - owner or non-owner events are to be generated for the mailboxTo change this setting, place your cursor in the Status cell, click the arrow control and select theappropriate option from the list.11 Click Close to save your selections, close the dialog, and return to the Exchange Mailbox Auditing page.