I recently investigating a mailbox that accidentally deleted.I have co staff who has access to users mailboxes and my problem is how will I know who deleted the mailbox.Is there a logs where I can look to?Thanks in advanceJess

Per my knowledge, we may obtain such information by raising the level of certain diagnostic logging to Maximum, but the default level shall be Lower. So, I think we cant know whos deleted the mailbox at this time If you want to know if there are events for such information, please tell me the version of the exchange, so I can do a local test to see if we can monitor the mailbox deletion in the future

Thanks for the reply.My exchange 2003 version is 6.5.7638.1

So, I did further research and heres the method to audit the mailbox deletion: Enable the auditing of Directory Service Access (KB 232714), which will give us the success/failure attempts by any user to access the AD. Actually, we just need to check the success since the failed attempt wont delete mailbox Then the success of mailbox deletion will generate event 565 and 566, which can tell us the name of the person who delete the mailbox and the name of the person whose mailbox has been deleted Notes: My post in this thread will also help you for this issue Notes: Enable the auditing of Directory Service Access will have certain impact on server performance

Thank you very much James! I try this info but Im little bit hesistant due to impact on server performance.Anyway, thanks for the help.