Exchange 2010 : logging Public Folder mail deletion

Hi Experts,

I have to monitor message deletion inside a PF (find who deleted mesasges and at what time to be precise).

I found the Get-PublicFolderItemStatistics PS command but I don't know how to identify the user concerned for modification. It looks like that we can only see existant messages and not deleted ones.
I tried to activate PF logging in Exchange EMC (server config -> Properties -> Diagnostics Logging tab -> Services -> MSExchangeIS -> Public) but I do not know wich one to choose, maybe "Access Control", General and Views, but I do not know what does it is exactly...
I don't know where to search...

Thank you in advance for your help, best regards,
jet-infoAsked:
Who is Participating?
 
Felix LevenConnect With a Mentor Senior System and DatabaseadministratorCommented:
NO way, Microsoft's advice is to turn away from Public Folders since Exchange 2007 on and they try to sell SharePoint as an option for this.

Get-PublicFolderStatistics can Show you "DeletedItemCount" and "TotalDeletedItemSize"

Get-PublicFolderStatistics -Identity \it\mail2012 | fl

Open in new window

0
 
Felix LevenSenior System and DatabaseadministratorCommented:
General -> Medium should be OK

Shell:
set-eventloglevel “msexchangeis/9001 public/general” -level medium

in sp2 it is possible to use “set diagnostic logging” in the action pane if you select the server object. This also works for Exchange 2010.
0
 
jet-infoAuthor Commented:
Thank you, I activated logging for the PF as you told me.

Could you please tell me in which log I can find the logged informations ?

Thanks again for your help !
0
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

 
Felix LevenSenior System and DatabaseadministratorCommented:
'Application Log' is what you are looking for.
0
 
jet-infoAuthor Commented:
You simply mean the eventvwr 'Application Log' ?
If so, do you know which event ID to search for mail deletion ?

Thank you for your help Felix !
0
 
Felix LevenSenior System and DatabaseadministratorCommented:
I was wrong sry, it is not possible to audit a public folder on item Level (mails etc.) you can only track the deletion of public folders.


http://technet.microsoft.com/en-us/library/jj552408(v=exchg.150).aspx

Does mailbox audit logging work against public folders?

No. Not at this time.
0
 
jet-infoAuthor Commented:
So there is no way to know which user deleted a mail in a PF ?
If so, it is really bad from Microsoft because we can't know either the time at which the message was destroyed... and the Get-PublicFolderItemStatistics command don't show deleted messages isn't it ?

Thanks again for your help.
0
 
jet-infoAuthor Commented:
Thank you very much for your help Felix !
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.