SID on Exchange Mailbox

Is there any way to track when someone may have created an AD account then added it to an Exchange mailbox via Manage Full Access Permission to gain access to the mailbox then delete it?

Also, is there any way to find out what date this may have taken place?
Who is Participating?
Manpreet SIngh KhatraConnect With a Mentor Solutions Architect, Project LeadCommented:
Manpreet SIngh KhatraSolutions Architect, Project LeadCommented:
Maybe an eventID ..... not anything else.

- Rancy
iNetSystemAuthor Commented:
There's no way to convert a SID to the SAM?
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

Manpreet SIngh KhatraSolutions Architect, Project LeadCommented:
There's no way to convert a SID to the SAM? -- Sorry didnt get you :(
iNetSystemAuthor Commented:
I am trying to investigate who or what previous account would have had access to this users mailbox.  It looks like the SID has been retained on the mailbox because the account was deleted in AD.

I was wondering if there is any tool that can tell me what deleted account was associated with the remaining SID.

You may user powershell to do converting:

#This powershell must run in windows Powershell, do not run in Windows Powershell ISE
$objSID = New-Object System.Security.Pricipal.SecurityIdentifier `
$objUser = $objSID.Translate( [System.Security.Principal.NTAccount])

Open in new window

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.