cancel
Showing results for 
Search instead for 
Did you mean: 

Any way to find out who deleted a users mailbox archive

MRWALLEYE
Level 3

Recently we noticed a mailbox went missing in Evault. Is there anyway to find out who deleted the mailbox archive?

Thanks

1 REPLY 1

GertjanA
Moderator
Moderator
Partner    VIP    Accredited Certified

Hello,

Are you sure it is missing? Sometimes a name change of the mailbox in Exchange changes the name of the archive.

Anyway. If you have auditing enabled, you might be able to get something from that. Otherwise (as you don't seem to know when it went missing), you might be able to go through the eventlog and see if you can spot something there. I believe it is logged when an archive deletion starts, but not sure. Based on that, see what you can find on otherlogs about logons.

Additionally, it might be you can get some info from the EV dab's in general. See (for instance) the Direcdtory DB, ExchangeMailboxEntry table and find the mailbox in there.

good luck.

Regards. Gertjan