Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
Solved

deleted evidence exchange 2010

Posted on 2014-07-24
4
270 Views
Last Modified: 2014-07-30
Is there anyway in exchange 2010 to get a report of what time

A.. what time emails were deleted by a user and subsequently moved to the deleted items folder

B.. emptied from a deleted items folder into the recover deleted items folder

C.. the date and time a user purged emails from the recover deleted items folder so they were no longer recoverable
0
Comment
Question by:pma111
  • 2
4 Comments
 
LVL 19

Assisted Solution

by:Kash
Kash earned 250 total points
ID: 40216587
I am not sure without Auditing it is quite possible though. You need to enable mailbox auditing >>> http://technet.microsoft.com/en-gb/library/ff459232%28v=exchg.141%29.aspx
0
 
LVL 12

Accepted Solution

by:
David Paris Vicente earned 250 total points
ID: 40216651
Hi,

By default Mailbox Owners are not audit because this will generate a lot of data.

If you enable audit logging for a user you can access to the mailbox audit log by PowerShell or through ECP.

For auditing a mailbox you have to enable it through Powershell
Ex: Set-Mailbox <Username> -AuditEnabled $true
then
Set-Mailbox <Username> -AuditOwner update,move,MoveToDeletedItems,SoftDelete,HardDelete

For reference you can check here Set-Mailbox


Then you can access to the audit by the ways I mention above.

Hope this helps.
Regards
0
 
LVL 3

Author Comment

by:pma111
ID: 40216673
Is there a command to see if mailbox auditing is enabled
0
 
LVL 12

Expert Comment

by:David Paris Vicente
ID: 40216760
Yes.
get-mailbox <username> | fl *audit*

Open in new window

0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article aims to explain the working of CircularLogArchiver. This tool was designed to solve the buildup of log file in cases where systems do not support circular logging or where circular logging is not enabled
How to resolve IMCEAEX NDRs in Exchange or Exchange Online related to invalid X500 addresses.
Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …

861 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question