Hello - I would like to know if there is any granular auditing for Outlook/Exchange items? I would like to know when and how an item was last edited/opened, preferrably with a history of changes or acesses. I know you can see who last modified and a date at the bottom of a contact, but that isnt enough, because there are a number of people in the contacts. Ultimately we suspect someone has been deleting email addresses from contacts and I want to track down exactly who did it, or at least what account was used to do it. I dont really care about tightening down the security, I want to find out who is doing it, and then we will address the security problem. Thanks

Hi , Please confirm that for which version you are looking for ? Also I M pasting a link here which will help you in this regard. http://www.msexchange.org/articles_tutorials/exchange-server-2007/compliance-policies-archiving/exchange-2007-mailbox-access-auditing-part1.html Regards. Shafaquat Ali.M.C.I.T.P Exchange 2007 M.C.I.T.P Windows Server 2008 M.C.T.S OCS Server 2007 R2

Exchange 2007 (SBS 2008) Outlook 2007 Thanks

Followup question. On some of the contacts it says last modified on xx/xx/xxxx by username. Where is this information stored and what other information like this is stored? I have enabled diagnostics auditing and it is overwhelming the amount of data that is collected. But, it is better than nothing. Still fine tuning exactly what we want.

When you say "contacts" are you talking about mail-enabled contacts in the Global Address List? If so, that is an Active Directory auditing issue, not Exchange. If it is "contacts" that are found in an individual user's Contacts folder, I think the mailbox auditing found in Exchange 2007 SP2 or SP2 might help. In the EMC, look at the Servers, select your mailbox server, then run the Manage Diagnostic Logging wizard, drill down to MSExchangeIS -> 9000 Private and set the logging to "Low" for the Message Access category. Then test modifying a contact. I "think" this will do what you need, but it will also generate a LOT of extraneous information.Jim McBee - Blog - http://mostlyexchange.blogspot.com

Contacts as in contacts in a Mailbox in Outlook (not GAL/AD). If you share a contact folder with someone else and then they modify a contact within, there is a little tag in the lower right corner that says last modified on xx/xx/xxxx by username. Yes we do have auditing enabled and it is a lot of extra information (first reply suggested this). That is why I am wondering where this tag is kept and what other information may be stored in there.

Hi, Per my knowledge, increase Diagnostics Logging of Exchange IS is the only way to achieve the goal, though it will provide lots of extraneous information.