Hi Sir's,

Is there a way to check what happens to the email after it receive by mailbox? is there a shell script to check if a paritcular email was move or delete?

thank you, 

Hi ,

1.You can make use of the E-discovery search or search-mailbox command to check whether that particular mail is available in an exchange mailbox or not.

We could not search for the mails which is moved to the PST files.

2.Second option is to enable the mailbox audit to monitor the activities of the owner as well as the delegate users who have access over that mailbox .

As said above, Either you can use E-discovery to search email or enable auditing to track email flow. It might give you some clue for the same.

To enable auditing, you may follow this informative PDF guide that helps to enable auditing and track email reports into real time : http://www.lepide.com/guide/enabling-exchange-2010-mailbox-auditing.pdf

Hi,

You can enable mailbox audit logging to log the action (copy, create, move, HardDelete, SoftDelete and so on) owner or delegate done. When you enable audit logging for a mailbox, you can specify which user actions (for example, accessing, moving, or deleting a message) will be logged for a logon type (administrator, delegate user, or owner).

For more information, here is a helpful article for your reference.

Mailbox audit logging

https://technet.microsoft.com/en-us/library/ff459237%28v=exchg.150%29.aspx?f=255&MSPPError=-2147217396

Hope this can be helpful to you.

Best regards,