Hi, I've got a really simple problem which is driving me bonkers. Where can I find specific information regarding who created a mailbox on my Exchange 2003 server. We have several messaging admins and I'm trying to track down one rogue one. I've found the mailbox creation date using MFCMapi, however no matter where I look, be it on the mailbox, in AD using Adsiedit or even in the security logs on the server itself, I can't seem to find who actually created the mailbox!! Can someone point me in the right direction, even if it's in one of the previously mentioned locations and I've just missed it. Thanks for your help Simon

Hi, Pretty sure that this is not logged anywhere on the object. You will need to have auditing enabled and then you should be able to see this in the security log. Leif

Pretty much what I thought really.. Would you mind detailing some of the auditing options I'll need to pick this up.. Thanks again

Pretty much what I thought actually.. Would you mind detailing the steps to enable this.. I think I've already got it enabled, just need some clarification.. Thanks again

Hi, If you on the user objects enable auditing for write access and then enable audit for object access you should see what happens. Leif

Hiya, thanks for the reponse, I've enabled auditing at the database level (testing on one specific server, storage group and db) from within ESM. Enabled Object Access auditing, both success and failure in the local security policy and whilst I'm gettting object access messages in the security log from the likes of System etc, I'm not getting anything when a mailbox is created / deleted anything.. I've even gone so far to audit all actions, not just write and still nothing. Am I missing something? Please help, this is driving me mad now.. Thanks

Hi, Enable auditing on the user level (in Active directory) not on the mailbox level. Leif

Hi Leif, Thanks for the that. Would I just enable the auditing at the OU level then (Presuming the user will be created in this OU, I suppose I could also change it to the domain), which options do I need specifically? I'm only trying to show / highlight when a mailbox is created as to whom the mailbox creator is. Thanks for your help

Hi, Look for attribute PR_CREATOR_SID with MFCMAPI. May be this is what you need. Regards, Dmitry

Hi , I'm getting an error when i'm trying to get mailbox information for other users ? using the tool,i'm getting my mailbox information without any problem. The tool is closed immediatly after i select the user from my address list,i think it throws an exception which cause the tool to be closed. Any help ?

Have you checked the mailbox permissions?