Auditing Exchange Journal archive search entry history ?

[John_Santana]

Hi People,

For the compliance purpose of the HR and security department, where and how can I view who have perform access and search using the Enterprise Vault web client to the EV Journal mailbox  ?

[Rob_Wilcox1 · Accepted solution]

Your first port of call is to look at the journal archive, and go to the permissions tab.

Who has access there? Only those people will have done *any* kind of search.

Do you have DA/CA?

[John_Santana]

ah ok, no I do not have DA/CA installed.

is there any log or event that can be viewed ? maybe IIS logs ?

[Rob_Wilcox1]

Your first port of call is to look at the journal archive, and go to the permissions tab.

[TonySterling]

Did you implement Auditing?  As Rob said, check the permission tab of the Journal archive to see who has access.

One note, if the Vault Admin account are known by many people you will have a hard time proving who did what.