[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
Solved

# Exchange 2010 : logging Public Folder mail deletion

Posted on 2014-01-21
Medium Priority
2,400 Views
Hi Experts,

I have to monitor message deletion inside a PF (find who deleted mesasges and at what time to be precise).

I found the Get-PublicFolderItemStatistics PS command but I don't know how to identify the user concerned for modification. It looks like that we can only see existant messages and not deleted ones.
I tried to activate PF logging in Exchange EMC (server config -> Properties -> Diagnostics Logging tab -> Services -> MSExchangeIS -> Public) but I do not know wich one to choose, maybe "Access Control", General and Views, but I do not know what does it is exactly...
I don't know where to search...

0
Question by:jet-info
• 4
• 4

LVL 13

Expert Comment

ID: 39796779
General -> Medium should be OK

Shell:
set-eventloglevel “msexchangeis/9001 public/general” -level medium

in sp2 it is possible to use “set diagnostic logging” in the action pane if you select the server object. This also works for Exchange 2010.
0

Author Comment

ID: 39796846
Thank you, I activated logging for the PF as you told me.

Could you please tell me in which log I can find the logged informations ?

Thanks again for your help !
0

LVL 13

Expert Comment

ID: 39796874
'Application Log' is what you are looking for.
0

Author Comment

ID: 39796928
You simply mean the eventvwr 'Application Log' ?
If so, do you know which event ID to search for mail deletion ?

Thank you for your help Felix !
0

LVL 13

Expert Comment

ID: 39797452
I was wrong sry, it is not possible to audit a public folder on item Level (mails etc.) you can only track the deletion of public folders.

http://technet.microsoft.com/en-us/library/jj552408(v=exchg.150).aspx

Does mailbox audit logging work against public folders?

No. Not at this time.
0

Author Comment

ID: 39797677
So there is no way to know which user deleted a mail in a PF ?
If so, it is really bad from Microsoft because we can't know either the time at which the message was destroyed... and the Get-PublicFolderItemStatistics command don't show deleted messages isn't it ?

0

LVL 13

Accepted Solution

Felix Leven earned 2000 total points
ID: 39797778
NO way, Microsoft's advice is to turn away from Public Folders since Exchange 2007 on and they try to sell SharePoint as an option for this.

Get-PublicFolderStatistics can Show you "DeletedItemCount" and "TotalDeletedItemSize"

Get-PublicFolderStatistics -Identity \it\mail2012 | fl

0

Author Closing Comment

ID: 39799297
Thank you very much for your help Felix !
0

## Featured Post

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This month, Experts Exchange sat down with resident SQL expert, Jim Horn, for an in-depth look into the makings of a successful career in SQL.
Steps to fix “Unable to mount database. (hr=0x80004005, ec=1108)”.
The video tutorial explains the basics of the Exchange server Database Availability groups. The components of this video include: 1. Automatic Failover 2. Failover Clustering 3. Active Manager
This video discusses moving either the default database or any database to a new volume.
###### Suggested Courses
Course of the Month19 days, 2 hours left to enroll