General discussion

Locked

How to tract creating/deleting mailbox

By abyanfiat ·
I have given given two user permission to create and delete mailbox but sometime they do mess up either creating or deleting mailbox. How do i find out who create or delete mailbox?

This conversation is currently closed to new comments.

2 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

How to tract creating/deleting mailbox

by brasslet In reply to How to tract creating/del ...

Turn on Directory Service diagnostics logging for security.

1. Open the Exchange Administrator program and connect to the server you
wish to audit.

2. Open the server's properties and click on the Diagnostics Logging
tab.

3. Select MSExchangeDS, and in the left pane, select Security.

1. Select the Maximum radio button, and then click OK.


Do this for every server you wish to audit. To view access to objects on a particular server, open the Application Event log on the specific
Exchange server. Filter to show only those events from source MSExchangeDS.

An event 1053 is logged when objects are changed; the event records the username and the computer used to make the change. The following is an
example of an event logged when a user is removed from a distribution list called "BigDL."

User: YourDomain\ExchangeAdmin
Computer: YOURSERVER
Event I 1053
Source: MSExchangeDS
Type: Information
Category: Security
Description: The security descriptor granted 0x2
access on object /o=yourorg/ou=yoursite/cn=Recipients/
cn=BigDL for this user.

Collapse -

How to tract creating/deleting mailbox

by brasslet In reply to How to tract creating/del ...

You'll see similar events whenever an object in the directory (mailbox, DL, customer recipient etc.) is changed, added or deleted.

Back to Software Forum
2 total posts (Page 1 of 1)  

Related Discussions

Related Forums