Hello, We would like to know if it is possible to find out whether an email has been read and possibly subsequently marked as unread or deleted. Is there any audit trail available? Robbie

Read Receipt is the option which is on the client. Which exchange version you are using ?Gulab | MCTS-MCITP Messaging: 2010 | MCTS-MCITP Messaging: 2007 | MCC 2011 | Skype: Gulab.Mallah

2010 SP1 without read receipts selected on the client Robbie

No auditing trail for this level of granularity, since the user can read and then click unread the message skewing the last modication time vs receive time. If I see that the creation time and last mod time is the same then it hasn't been read. However just because it's different doesn't indicate that it's read, rules moving the message or any other process can tamper with the timestamp plus many other possible scenarios. The only way is to audit trail but there is no feature.James Chong MCITP | EA | EMA; MCSE | M+, S+ Security+, Project+, ITIL msexchangetips.blogspot.com

Additionally one's settings can be such that reading the message in the preview pane does not mark the message as read. Or (as often happens ot me) you can read a reply to the origional whihc includes the origional so you skip reading the first message (and/or delete the first without bothing to read it).

Hi James and Chris have explained audit trail to you. Too many process and action affect last modify time and status of original email. So the idea is difficult to realize.Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Thanks I didn't think it was possible but I was asked to find out Robbie