Exchange 2003 Mailbox Deleted

I was asked to check on the status of a user mailbox today so I checked the AD account and no exchange tabs.  I then went to Exchange System Manager to double check and confirmed the user mailbox was gone.  I restored mailbox stores into RSG (6 weeks) and still could not find mailbox.

Is there a log I can check that may tell me who initiated the purge and when the mailbox was deleted?

Who is Participating?
ZamZ0Connect With a Mentor Commented:
In Exchange Manager you can use the Mailboxes and Logons objects to view who used a mailbox last. You can also further configure mailbox auditing by going on the Diagnostics Logging tab->MSExchangeIS->Mailboxes object. Select the Logons and Access Control categories and set them to Maximum.
RHaines2Author Commented:
Apologies for the late response and thanks for your input.  I have checked those settings and made some adjustments accordingly keeping in mind increased logging and available space on my server.  If I read between the lines of your response I'm guessing if those categories had no logging level specified I have no way of finding out who may have deleted the users mailbox.  Does that sound correct?

BTW: With the increased logging I'm now seeing more 1029 event entries.  I could create and delete a test mailbox but off-hand do you know if a mailbox delete would show-up as an event 1029 or would that have it's own event number?
It might, it could be a different id# as well. You are right, if those categories had no logging level specified, but I think that by default they would have had some kind of logging going on. Have you checked the audit logs?
RHaines2Author Commented:
Prompt responses to additional questions.
RHaines2Author Commented:
I will scrub the logs again and filter the searches.  I just got to get familiar with the event entries because some of them appear cryptic to me.  Thanks for your assistance and if I find anything I will follow-up with another post.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.