Deleted mailbox event in the mailbox audit?
In exchange server 2007 sp2, I plan to enable to mailbox audit feature. Now, I would like to know,what will be the event generated if anyone deleted the exisiting mailbox from the server? ThanksFunnyghost
November 2nd, 2011 8:54am

Create a test mailbox and delete it, see what event is logged :-)Sukh
Free Windows Admin Tool Kit Click here and download it now
November 2nd, 2011 6:48pm

Nope, its' not a good idea dude :)Funnyghost
November 2nd, 2011 9:04pm

Hi Enable the auditing of Directory Service Access (KB 232714), which will give us the success/failure attempts by any user to access the AD. Actually, we just need to check the “success” since the failed attempt won’t delete mailbox Then the success of mailbox deletion will generate event 565 and 566, which can tell us the name of the person who delete the mailbox and the name of the person whose mailbox has been deleted. You can read similar case . http://social.technet.microsoft.com/Forums/en-US/exchangesvradmin/thread/870d5f3e-d7b7-4703-bec7-89d3ee770c41
Free Windows Admin Tool Kit Click here and download it now
November 3rd, 2011 11:58am

It is for Windows 2000 DC. But I have Windows 2008.Funnyghost
November 8th, 2011 1:39pm

It is for win 2000 and 2003. You can audit AD to achieve your aim. You can open audit windows 2008 thread to server forum. http://social.technet.microsoft.com/Forums/en-US/winserverManagement/threads
Free Windows Admin Tool Kit Click here and download it now
November 8th, 2011 7:34pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics