In exchange server 2007 sp2, I plan to enable to mailbox audit feature. Now, I would like to know,what will be the event generated if anyone deleted the exisiting mailbox from the server? ThanksFunnyghost

Create a test mailbox and delete it, see what event is logged :-)Sukh

Nope, its' not a good idea dude :)Funnyghost

Hi Enable the auditing of Directory Service Access (KB 232714), which will give us the success/failure attempts by any user to access the AD. Actually, we just need to check the “success” since the failed attempt won’t delete mailbox Then the success of mailbox deletion will generate event 565 and 566, which can tell us the name of the person who delete the mailbox and the name of the person whose mailbox has been deleted. You can read similar case . http://social.technet.microsoft.com/Forums/en-US/exchangesvradmin/thread/870d5f3e-d7b7-4703-bec7-89d3ee770c41

It is for Windows 2000 DC. But I have Windows 2008.Funnyghost

It is for win 2000 and 2003. You can audit AD to achieve your aim. You can open audit windows 2008 thread to server forum. http://social.technet.microsoft.com/Forums/en-US/winserverManagement/threads