Audit changes to calendar on Room Mailbox?

jbla9028
jbla9028 used Ask the Experts™
on
I got a request to track down who deleted a calendar event on a room mailbox. In other words...

"Jane had a meeting scheduled at 8am in The Exchange Room. She said someone deleted it. Find out who deleted it."

I see this article but not sure it's what I'm looking for. I think this audits changes to the mailbox properties? http://exchangeserverpro.com/exchange-2010-mailbox-audit-logging/

What would be the process to track this type of event? thank you.


Exchange 2010
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
View Solutions Only
Commented:
First of all you have to enable autditing on mailbox. Then simulate the issue after that run report to get the information.

The hard maybe to simulate, since if you keep auditing for ever, it will consume the Exchange disk space. However, you can set how long the audit will enable.

https://social.technet.microsoft.com/Forums/exchange/en-US/09b14fd1-4d3b-499d-a528-cc45698b4f52/config-audit-user-calenda?forum=exchange2010
Adam (CodeTwo Software)IT Animal
Commented:
Mailbox Audit Logging is what you want. Among other actions, it tracks hard and soft deletes by the admin and delegate of a mailbox.

As for past deletes, you may be able to see who performed them using MFCMAPI. See my comment in the link for more: http://www.codetwo.com/admins-blog/user-mailbox-and-shared-mailbox-auditing-in-exchange-2013/?sts=5824#comment-969
jbla9028

Author

Commented:
Thanks guys

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial