Shared Mailbox User Tracking

Question

We have a shared mailbox in our company, now someone has forwarded a mail from the shared mailbox, but no one wants it to have been, how can i track it ? the originalclientip in exchange message tracking is empty

Answer 1

You can use the Exchange auditing features. But you need to make sure the sharedmailbox’s auditlog has been enabled.

Set-Mailbox -Identity shared1 -AuditEnabled $true

Then run the follow command to track who logs on and forwards email from the shared mailbox.

Search-MailboxAuditLog –Identity shared –LogonTypes Delegate –ShowDetails

If you didn’t enable the auditlog for the shared mailbox before, you would not be able to trace who sends email from the shared mailbox.