Enabe mailbox auditing Exchange 2010

Set-Mailbox -Identity User2 -AuditEnabled $true Then configure what you want to audit: Set-Mailbox -Identity user2 -AuditAdmin copy,MoveToDeletedItems,move,update,folderbind,messagebind -AuditOwner Update,Move,MoveToDeletedItems,SoftDelete,HardDelete -AuditDelegate Update,MoveToDeletedItems,SoftDelete,HardDelete,SendAs,Create -AuditEnabled $true Then use exchange control panel to search the logs: https://yourmail.server.com/ecp