Link to home
Start Free TrialLog in
Avatar of Edward Cho
Edward ChoFlag for United States of America

asked on

Tracking Deleted Messages

Hello Everyone!

We have an Exchange 2016 server and one of our users is finding that their messages are being deleted.  I'd like to track down which device it is being deleted from and when.  I know I can track this for all non-owners via audit logs "Search-MailboxAuditLog USERNAME -LogonTypes Delegate -ShowDetails" but was wondering if its possible to track for Owners?

I tried "Search-MailboxAuditLog USERNAME -LogonTypes Owner -ShowDetails" but it comes back blank.  

Thanks in advance.
ASKER CERTIFIED SOLUTION
Avatar of Adam Brown
Adam Brown
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
I hope the above suggestions clarifies your concern to get this this job done. Moreover, get help from this article which lets you to learn about the specific logon types and user actions that can be audited when mailbox audit logging is enabled for user mailboxes in Exchange 2016: https://technet.microsoft.com/en-us/library/ff459237(v=exchg.160).aspx

Also get help from this link:
https://community.spiceworks.com/how_to/124782-how-to-track-non-owner-mailbox-accesses-on-exchange-2013

Hope this helps!