Exchange 2013 - Mailbox Auditing

Question

Hi all,
Like to check what is the event id that will appear on Windows Event Viewer when a mailbox is access by someone else?
For exchange 2007, the event id is 10100. I cannot seems to find the id for 2013 on the net.
Also, if I wish to monitor exchange administrator if they are accessing any other person's mailbox,
Would this power shell command be enough to turn on what I wish to monitor?
Set-Mailbox -AuditEnabled:$true
Thanks!
Zack

Answer 1

Hi Zack,
Thank you for your question.
Mailbox audit logs are generated for each mailbox that has mailbox audit logging enabled. Log entries are stored in the Recoverable Items folder in the audited mailbox, in the Audits subfolder. By default, mailbox audit log entries are retained in the mailbox
for 90 days and then deleted. We could modify this retention period by using the AuditLogAgeLimit parameter with the Set-Mailbox cmdlet. We could use the following command to enable mailbox audit logging:
Set-Mailbox –Identity <Username/Email address> -AuditEnable $ture
To verify that we have successfully enabled mailbox audit logging for a mailbox and specified the correct logging settings for administrator, delegate, or owner access, use the Get-Mailbox cmdlet to retrieve the mailbox audit logging settings for that mailbox.
This example retrieves Ben Smith’s mailbox settings and pipes the specified audit settings, including the audit log age limit, to the Format-List cmdlet.
Get-Mailbox "Ben Smith" | Format-List *audit*
The more details will be referred by the following link:
https://technet.microsoft.com/en-us/library/ff459237(v=exchg.150).aspx
If there are any questions regarding this issue, please be free to let me know. 
Best Regard,
Jim
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
Jim Xu
TechNet Community Support