Hi, we have a exchange servers on the internal network and all the incmoing emails hit the DMZ / firewall servers first.Exchange servers are on 2000 / 2003. we had a maintanecne on one of the exchange server ( exhange 2000/2003 ) over weekend and couple of mailbox stores were deleted and recreated before some of the mailboxes were actually moved to another store.The issue is when user came in during the week they observed that the old emails are missing but still able to send / receive new emails. we performed the restoreto recover the mail items. Now the issue is we had a significant gap of 12 hours between mailbox store deletion and re-creation, and since we had few active users on that store. ( these users were not moved to different store and assuming that it was moved we deleted the store) We need to find out how many messages were acually missed for those users between this significant gap. How to find out what are email messages that were attempted to deliver for these users during this 12 hour window from the logs? kindly help with some event ID or SMTP key word logs.

Event ID isn't going to tell you anything as it doesn't record information about individual messages. Message tracking may give you some information, if it was enabled. Ditto for SMTP logs - the key is whether it was enabled and whether it was recording the correct information. Have you looked at the SMTP logs to see if they were recording information that was of use? Simon.Simon Butler, Exchange MVP Blog | Exchange Resources

Hi cma81, Per your description, there are no emailbox for the users' account, right? That said, if the external users/local users sent emails to the users, because they have no emilbox during the 12 hours, and there will no log for the delivery course. Regards! Gavin Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.