Link to home
Start Free TrialLog in
Avatar of jbla9028
jbla9028Flag for United States of America

asked on

User's mobile device was wiped - Exchange 2010

I have a user who had an issue where their cell phone got randomly wiped. They are connected to our Exchange 2010 email server. I noticed that the confirmation message was coming from our servers. I can't seem to figure out why he got a remote wipe. I don't see anything in the logs. indicating we wiped his device. I ran the command below on multiple servers and I only got 1 hit for a reset that occurred months ago and not even to the same user.

Get-ActiveSyncDevice -Mailbox {mailbox} | Get-ActiveSyncDeviceStatistics | select DeviceWipeSentTime, DeviceWipeAckTime

DeviceWipeSentTime                                          DeviceWipeAckTime
------------------                                          -----------------


Search-AdminAuditLog -cmdlets "clear-activesyncdevice"

I got one hit for a wipe that happened over a month ago and not the user in question.

any ideas where to look?
ASKER CERTIFIED SOLUTION
Avatar of Jackie Man
Jackie Man
Flag of Hong Kong image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of jbla9028

ASKER

Exchange 2010  CU 17

Android, not 100% sure on OS version

and do you mean an active sync policy? Yes we allow remote wipes.

thank you!
thank you for the help.