Link to home
Start Free TrialLog in
Avatar of ejefferson213
ejefferson213

asked on

Exchange 2010 Security

We recently had a case where some Exchange 2010 mailboxes got deleted for no known reason by who knows who.  So we'd like to track such activity, perhaps log this activity.  What is the best way of going about this?  

Thank you!
Avatar of Ganesh Anand
Ganesh Anand
Flag of Bahrain image

First Have you enabled Audit logging?

If you have enabled you can get using powershell.

Get-MailboxFolderStatistics "mailbox" -FolderScope RecoverableItems | ? {$_.Name -eq "Audits"} | Select identity,*items*

Search-MailboxAuditLog "mailbox" -LogonTypes Delegate -ShowDetails

Please refer step by step from : http://exchangeserverpro.com/exchange-2010-mailbox-audit-logging/

Also there is a script file for getting the log in better format:
http://mikepfeiffer.net/2010/08/administrator-audit-log-reports-in-html-format-exchange-2010-sp1/
Avatar of ejefferson213
ejefferson213

ASKER

Thanks for your comment.  This appears directed an individual mailbox auditing, however, I'm concerned with mailboxes that were deleted (not mail items).  What is the best way to track that activity?
ASKER CERTIFIED SOLUTION
Avatar of Ganesh Anand
Ganesh Anand
Flag of Bahrain image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Thank you very much; just what I was looking for!!!