ejefferson213
asked on
Exchange 2010 Security
We recently had a case where some Exchange 2010 mailboxes got deleted for no known reason by who knows who. So we'd like to track such activity, perhaps log this activity. What is the best way of going about this?
Thank you!
Thank you!
ASKER
Thanks for your comment. This appears directed an individual mailbox auditing, however, I'm concerned with mailboxes that were deleted (not mail items). What is the best way to track that activity?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Thank you very much; just what I was looking for!!!
If you have enabled you can get using powershell.
Get-MailboxFolderStatistic
Search-MailboxAuditLog "mailbox" -LogonTypes Delegate -ShowDetails
Please refer step by step from : http://exchangeserverpro.com/exchange-2010-mailbox-audit-logging/
Also there is a script file for getting the log in better format:
http://mikepfeiffer.net/2010/08/administrator-audit-log-reports-in-html-format-exchange-2010-sp1/