Exchange 2010, Server 2008

I presume the user has been fired? If not that should be your first step.

This isn't going to be an easy restore, because you have lost the link between AD and the server. Do you have a backup of the domain that you can restore? I don't think just adding the machine back to the domain is going to work.

Personally there is only one thing I would do here - and that is call Microsoft support (ideally using the culprit's credit card). This is one of those things that you need to get right first time and any bumbling around will decrease the chances of a successful restore. Get Microsoft to do it right, do it first time and that will be the best chance you have.

Otherwise you are looking at a lot of work, building a new Exchange server, then restoring the databases to a recovery database and generally adding everything back in again.

Simon.

Thanks Sembee, calling Microsoft was my next step.... Not my user to fire, but I hope something is done.

Quick question-- where can I find auditing on this action?  I need to prove that this was done, and when.

Did you have auditing enabled? If not then it isn't logged. If it was, then it should be on one of the domain controllers.

Simon.

Thanks Simon-- I did, but it doesn't go back that far.  Something as destructive as that should be logged anyway, just my 2 cents.  THANKS, ON CALL BACK WITH MICROSOFT, will advise. :-)

You can use eventcombMT tool to access all the log on single server.

 The cmd repadmin's /showobjectmeta can also be used to trace.

http://blogs.technet.com/b/abizerh/archive/2010/05/27/tracing-down-user-and-computer-account-deletion-in-active-directory.aspx

http://blogs.dirteam.com/blogs/tomek/archive/2006/09/21/Auditing-directory-changes-aka-_2600_quot_3B00_Who-deleted-this-object_3F002600_quot_3B00_.aspx

This fixed it.