Solved

deleted evidence exchange 2010

Posted on 2014-07-24
4
274 Views
Last Modified: 2014-07-30
Is there anyway in exchange 2010 to get a report of what time

A.. what time emails were deleted by a user and subsequently moved to the deleted items folder

B.. emptied from a deleted items folder into the recover deleted items folder

C.. the date and time a user purged emails from the recover deleted items folder so they were no longer recoverable
0
Comment
Question by:pma111
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 19

Assisted Solution

by:Kash
Kash earned 250 total points
ID: 40216587
I am not sure without Auditing it is quite possible though. You need to enable mailbox auditing >>> http://technet.microsoft.com/en-gb/library/ff459232%28v=exchg.141%29.aspx
0
 
LVL 12

Accepted Solution

by:
David Paris Vicente earned 250 total points
ID: 40216651
Hi,

By default Mailbox Owners are not audit because this will generate a lot of data.

If you enable audit logging for a user you can access to the mailbox audit log by PowerShell or through ECP.

For auditing a mailbox you have to enable it through Powershell
Ex: Set-Mailbox <Username> -AuditEnabled $true
then
Set-Mailbox <Username> -AuditOwner update,move,MoveToDeletedItems,SoftDelete,HardDelete

For reference you can check here Set-Mailbox


Then you can access to the audit by the ways I mention above.

Hope this helps.
Regards
0
 
LVL 3

Author Comment

by:pma111
ID: 40216673
Is there a command to see if mailbox auditing is enabled
0
 
LVL 12

Expert Comment

by:David Paris Vicente
ID: 40216760
Yes.
get-mailbox <username> | fl *audit*

Open in new window

0

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Many people use more than one email account and so it becomes difficult for them to manage them when they use separate accounts,  so, in this article, I have shared an easy way to add Other Mail Accounts in your Google Inbox. It helps to combine all…
The viewer will learn how to  create a slide that will launch other presentations in Microsoft PowerPoint. In the finished slide, each item launches a new PowerPoint presentation and when each is finished it automatically comes back to this slide: …
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an antispam), the admini…

737 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question