Hi Guys,

We have a shared mailbox and is accessed by more than 5 users.

Some one did something and the emails got deleted. I see them in recoverable deleted items folder.

Can anybody let me know how to find out who has deleted them ?

FYI - we do not have auditing enabled on this mailbox prior to deletion.

But using the MFCMAPI, I was able to figure out the last modification time (which is same for all the emails in this folder)

So, I think, if we can find who accessed this mailbox during that particular time, I will be near to solution.

Can you guys let me know how to check who accessed the shared mailbox at a particular time ?

Thank you in advance.

Hello,

If you did not enable the mailbox auditing logging for the mailbox, I am afraid there is no event to record the operations.

Mailbox audit logging

https://technet.microsoft.com/en-us/library/ff459237(v=exchg.150).aspx

Thanks,

Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

 

Exactly what Simon responded you.

If Mailbox audit logging is not enabled, you are in loss to find out the culprit, who deleted the email from shared mailbox.

Here I find an informative resource that helps to enable the auditing on exchange mailbox : https://gallery.technet.microsoft.com/Enabling-Exchange-2010-368786d3

Is there a way to get to know who accessed the mailbox at a particular point of time ?

Yes, the log will be seen like:

Thanks,

Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com