Hi, This is Amit Sharma Exchange Admin in 7N. Some user has deleted in our Exchange 2010. how i can know who has deleted the user and where i can get log for Object modfication. Please reply me asap. Thanks | Amt Sharma 09718105922

You need to have enabled administrator auditing first to capture that info. Set-AdminAuditLogConfig -AdminAuditLogEnabled $True http://exchangeshare.wordpress.com/2009/04/18/exchange-2010-what-are-your-admins-doing/ If the AD account was deleted you should be able to check your DCs security event logs (check all DCs) event id 630 Event ID: 630 Type: Success Audit Description: User Account Deleted: Target Account Name: %1 Target Domain: %2 Target Account ID: %3 Caller User Name: %4 Caller Domain: %5 Caller Logon ID: %6 Privileges: %7 This assumes you have also enabled account management logging in AD first. Audit account management http://technet.microsoft.com/en-us/library/cc737542(WS.10).aspxJames Chong MCITP | EA | EMA; MCSE | M+, S+ Security+, Project+, ITIL msexchangetips.blogspot.com

Hi Amit, Any updates? Frank Wang