Is there a way to tell who disabled a mailbox on Exchange 2007 SP3? A bunch of mailboxes were disabled, and nobody seems to know who did it. Any suggestions on how to determine who disabled the mailboxes?

A polygraph?Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."

Who moved my Cheese? You could always see what time they were disabled: Get-MailboxStatistics -database xxxx | where-object { $_.DisconnectDate -ne $null }

I already know when they were disabled, but I dont know by who.......that is the problem. No way to audit who disable the mailboxes?

Hi DVDKEA, Per my knowledge, there isn’t any good way in Exchange 2007. But maybe you can follow the workaround in this thread to have a try: Is there a way to audit who disables an Exchange 2007 SP2 mailbox? http://social.technet.microsoft.com/Forums/en-US/exchangesvradmin/thread/5b892ea7-5d70-485c-9905-2d4f28519712 Thanks, Evan Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.