Exchange 2010 : logging Public Folder mail deletion
Hi Experts,
I have to monitor message deletion inside a PF (find who deleted mesasges and at what time to be precise).
I found the Get-PublicFolderItemStatis
I tried to activate PF logging in Exchange EMC (server config -> Properties -> Diagnostics Logging tab -> Services -> MSExchangeIS -> Public) but I do not know wich one to choose, maybe "Access Control", General and Views, but I do not know what does it is exactly...
I don't know where to search...
Thank you in advance for your help, best regards,
I have to monitor message deletion inside a PF (find who deleted mesasges and at what time to be precise).
I found the Get-PublicFolderItemStatis
I tried to activate PF logging in Exchange EMC (server config -> Properties -> Diagnostics Logging tab -> Services -> MSExchangeIS -> Public) but I do not know wich one to choose, maybe "Access Control", General and Views, but I do not know what does it is exactly...
I don't know where to search...
Thank you in advance for your help, best regards,
ASKER
Thank you, I activated logging for the PF as you told me.
Could you please tell me in which log I can find the logged informations ?
Thanks again for your help !
Could you please tell me in which log I can find the logged informations ?
Thanks again for your help !
'Application Log' is what you are looking for.
ASKER
You simply mean the eventvwr 'Application Log' ?
If so, do you know which event ID to search for mail deletion ?
Thank you for your help Felix !
If so, do you know which event ID to search for mail deletion ?
Thank you for your help Felix !
I was wrong sry, it is not possible to audit a public folder on item Level (mails etc.) you can only track the deletion of public folders.
http://technet.microsoft.com/en-us/library/jj552408(v=exchg.150).aspx
Does mailbox audit logging work against public folders?
No. Not at this time.
http://technet.microsoft.com/en-us/library/jj552408(v=exchg.150).aspx
Does mailbox audit logging work against public folders?
No. Not at this time.
ASKER
So there is no way to know which user deleted a mail in a PF ?
If so, it is really bad from Microsoft because we can't know either the time at which the message was destroyed... and the Get-PublicFolderItemStatis
Thanks again for your help.
If so, it is really bad from Microsoft because we can't know either the time at which the message was destroyed... and the Get-PublicFolderItemStatis
Thanks again for your help.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Thank you very much for your help Felix !
Shell:
set-eventloglevel “msexchangeis/9001 public/general” -level medium
in sp2 it is possible to use “set diagnostic logging” in the action pane if you select the server object. This also works for Exchange 2010.