Solved

Is there a way to check if a user has deleted mail items?

Posted on 2009-04-07
4
369 Views
Last Modified: 2012-06-27
If mail has supposedly 'disappeared' from a group mailbox, is there a way to check i.e. through logs or something, if a specific user has deleted them?

The receipient policy in place would not have removed them as the emails were within the allowed timeframe.  Also, all emails in the inbox were reported to have just disappeared sometime between mid-morning and lunchtime and the receipient policy runs at 4am

Environment is Exchange 2003 SP2

Many thanks for any help.
0
Comment
Question by:sbickerstaff
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
4 Comments
 
LVL 8

Expert Comment

by:greesh_hem
ID: 24085989
If a particular user who is a member of that shared mailbox, and if he/she has deleted some emails then those emails would show up in that users deleted items. So you would need to look up each users deleted items to find those emails.
0
 
LVL 3

Author Comment

by:sbickerstaff
ID: 24086018
On the Thursday night backup, all the items are there.  On the Friday night backup, they aren't, only the few that were received on the Friday afternoon.  Using this Friday nite backup (after they 'disappeared') I've looked in the deleted items and recover deleted items for each user who has editor access, but there's nothing.

If the user did a shift + delete then it wouldn't go to their deleted items, but in a case like this, is there then anyway to track it?  We COULD restore the items, but we're trying to find out what has happened in there's a chance it could happen again.
0
 
LVL 14

Expert Comment

by:Raj-GT
ID: 24086059
You can use exmerge to search within the dumpster and recover all deleted mails within the retention period.

Exmerger > Extract and import > extract data > options > and Items from dumpster

0
 
LVL 25

Accepted Solution

by:
kieran_b earned 500 total points
ID: 24086078
Which also doesn't answer the question...

Long story short, no, not retrospectively - the best you could do is boost logging and then trawl through it in the future, but that is a whole world of hurt without using third party tools
0

Featured Post

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

MS Outlook is a world-class email client application that is mainly used for e-communication globally.  In this article, we will discuss the basic idea about MS Outlook, its advanced features, and types of MS Outlook File formats.
Unified and professional email signatures help maintain a consistent company brand image to the outside world. This article shows how to create an email signature in Exchange Server 2010 using a transport rule and how to overcome native limitations …
To show how to create a transport rule in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Mail Flow >> Rules tab.:  To cr…
The video tutorial explains the basics of the Exchange server Database Availability groups. The components of this video include: 1. Automatic Failover 2. Failover Clustering 3. Active Manager

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question