Exchange 2003 Mailbox Deleted

I was asked to check on the status of a user mailbox today so I checked the AD account and no exchange tabs.  I then went to Exchange System Manager to double check and confirmed the user mailbox was gone.  I restored mailbox stores into RSG (6 weeks) and still could not find mailbox.

Is there a log I can check that may tell me who initiated the purge and when the mailbox was deleted?

Thanks
RHaines2Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

ZamZ0Commented:
In Exchange Manager you can use the Mailboxes and Logons objects to view who used a mailbox last. You can also further configure mailbox auditing by going on the Diagnostics Logging tab->MSExchangeIS->Mailboxes object. Select the Logons and Access Control categories and set them to Maximum.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
RHaines2Author Commented:
Apologies for the late response and thanks for your input.  I have checked those settings and made some adjustments accordingly keeping in mind increased logging and available space on my server.  If I read between the lines of your response I'm guessing if those categories had no logging level specified I have no way of finding out who may have deleted the users mailbox.  Does that sound correct?

BTW: With the increased logging I'm now seeing more 1029 event entries.  I could create and delete a test mailbox but off-hand do you know if a mailbox delete would show-up as an event 1029 or would that have it's own event number?
0
ZamZ0Commented:
It might, it could be a different id# as well. You are right, if those categories had no logging level specified, but I think that by default they would have had some kind of logging going on. Have you checked the audit logs?
0
RHaines2Author Commented:
Prompt responses to additional questions.
0
RHaines2Author Commented:
I will scrub the logs again and filter the searches.  I just got to get familiar with the event entries because some of them appear cryptic to me.  Thanks for your assistance and if I find anything I will follow-up with another post.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Server Apps

From novice to tech pro — start learning today.