track email deletion in publich folders EX2013

If you did not set EventLog logging level for Exchange Public folders then no, you can't

First you need to enable Public Folders login

Set-EventLogLevel –Level High| Where-Object {$_.identity -like "MSExchangeIS\9001 Public*Replication*"}

Then You can check in Application Event log.

To check what logging level is set for your exchange run this command

Get-EventLogLevel –Server ExServer1 > C:\Temp\EventLevels.txt

To modify use
Set-EventLogLevel –Identity “MSExchange Control Panel\General” –Level High

But still I'm not sure If you can trace who delete public folder without setting on Audit on Email server

Reference
https://technet.microsoft.com/en-us/library/aa998905.aspx?tduid=(d801a4af066f4719829ae0514f91b09a)(256380)(2459594)(TnL5HPStwNw-piNXVmR8a1kyVZRxbZYD6Q)()

I agree with Tom , you need to enable Diagnostic Logging to find Deletion of Public folder, after enabling diagnostic Logging, When a Public Folder is deleted Event ID 9682 is logged in the Application log. You can search for the evet Id 9682 in the application Logs to find who deleted public folder.

Hi,

when I change this level to high, I can log PUBLIC FOLDERS when they are deleted ?
What is all included in this “MSExchange Control Panel\General” ??

Hi VIRAL,

by DIAGNOSTIC LOGGING you mean this :

Set-EventLogLevel –Identity “MSExchange Control Panel\General” –Level High

How to enable Exchange Server public folder logging: http://searchexchange.techtarget.com/answer/How-to-enable-Exchange-Server-public-folder-logging

Diagnostic Logging to find Deletion of Public folder. To identify this we have to Enable logging on Public folder.  Below has the steps to enabled the same

- Open Exchagne Management Console
- Expand and select Server Configuration
- On the right you will find all the servers
- Select the Exchange Server where public Folder Database is residing
- Right click on the Server and select Manage Diagnostic Logging
- Expand to reach MSexchangeIS-> 9001 public and click on General and  
- Select Medium and configure to enable this settings
- When a Public Folder is deleted Event ID 9682 is logged in the Application log. You can search for the evet Id in the application logs.

Source: https://smtpport25.wordpress.com/2010/02/04/diagnostic-logging-to-find-deletion-of-public-folder-in-exchange-2007-and-exchange-2010/

Hope this helps!

Hi KEVIN,

I have EXCHANGE 2013 as you can read in my headline !!!!!!!!!!!
Your description is wrong for EX2013.

Hi I tested it and I have enabled it.
But I cannot see any event with 9682 when I delete a folder inside a public folder.

Ok this works just for Mailboxes.
it is not possible to track email deletion in public folders in EX2013.
Here you need an extra tool.