Hi .. I would like to trace who delete the mailbox for one of the user ? Currently we have exchange 2007 with SP1 I have checked in windows event but couldn't find it... Thinking to use some third-party tools.. Any tools within Exchange GUI or CLI ?? Appreciate your assistance.. Thanks

If you didn't have audit logging turned up high enough so that it was recorded in Event Viewer, then it isn't recorded anywhere else. Third party tools all depend on the activity being logged somewhere - and that is usually in one of the Windows logs. It isn't recorded elsewhere. Of course you are also dependant on having unique user accounts, rather than everyone logging in as a Administrator or similar. Simon.Simon Butler, Exchange MVP. http://blog.sembee.co.uk , http://exbpa.com/

Agreed with Sembee, We did practised in enviroment where every administrator must login using their own account while doing administrative tasks

Thanks for your responses... I have been told that there is an way which is PowerShell and inputting some cmd and we can see the status... i am not sure how it works .. Do you have any idea how can we trace with powershell ? Infact we all use our own admin credentials to login to exchange server .. checking in the events logs are very stuff since we dont know when the user email was deleted and you know event logs has bounch of events... Would you kindly let me know what is the eventID register in event log when any email box is deleted ? Thanks