Hi, Can some one advice me the event ID for mail box deletion. We are running on Exchange 2007 and baseline Auditing for exchange objects enabled ( http://technet.microsoft.com/en-us/library/ee331009(EXCHG.80).aspx#Enable). But we have few DCs so it's bit difficult to trace a mil box deletion occured recently. I am looking for the EVENTID number for a mail box deletion.

For auditing the mailbox deletion, you need to use “Directory Service Access” in that white paper Check account that delete mailbox (Similar thread)James Luo TechNet Subscriber Support (http://technet.microsoft.com/en-us/subscriptions/ms788697.aspx) If you have any feedback on our support, please contact tngfb@microsoft.com