when i delete a mailbox, what is event ID # will report in application logs ?
i need to find that ID to see who delete the mailbox.

On Thu, 1 Jun 2006 09:35:02 -0700, drpepper
<drpep***@discussions.microsoft.com> wrote:

Unless you're actually auditing it won't log. And even then I'm not
sure a mailbox deletion is logged explicitly as such. Are you sure the
mailbox got deleted? It's probably still there as an orphaned mailbox
(or did you already know that and just want to trace the culprit who
made you recover the mailbox?)

We found the mailbox and were able to recover it.. what happen was, this is
one of VIP user and someone wasn’t suppose to delete any mailboxes.. as you
can imagine, every manager is flipping out and someone job is on the line. We
are trying to investigate when was deleted and by who.. at the same time, we
have over 50, 000 users in our company and this task can be impossible task,
to find who deleted and when..

My next best bet is find that event ID and do a queryevent command to export
that all those ID’s and sort it out from there..

But, are u aware when mailbox is being deleted it would generate Event ID ?


Show quoteHide quote

No dice, unless you had Account Management Event auditing on, which
isn't by default.

You know you can't actually accidentally delete a mailbox don't you.
You can delete an account which orphans a mailbox (red x against it in
ESM etc.) but not the MB.

You could use ADFIND to see if the properties on the deleted object
has the details of the deleter on the account.

Nope, forget that ADFIND bit. Sorry.

Antivirus and Spam
Back-end Server
Routing Groups?
I'am running weboutlook I can't send any mails to a user in my com
GroupWise Coexistence