Does anyone knows, how to find who has deleted the mailbox in exchange 2007 server.I don't find any useful event other than the below event logs;Event Type: InformationEvent Source: MSExchangeIS Mailbox StoreEvent Category: General Event ID: 9533Date: 1/25/2010Time: 12:22:46 PMUser: N/AComputer: TEST1Description:The user account for 'test sia1' does not exist in the directory or is not enabled for Exchange mail. This mailbox will be removed from mailbox store 'Third Storage group/Mailbox Databse3' in 30 days For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.Funnyghost

How many accounts have the necessary permissions to mailbox-disable an account?They would need Exchange Recipient Administrator permissions.

It sounds like you need auditing. Here are some articles that I found on Exchange auditing:Exchange 2007 SP2 Auditing Whitepaper:http://blogs.technet.com/mikelag/archive/2009/08/25/exchange-2007-sp2-auditing-whitepaper.aspxConfigure Auditing to Track Exchange Server Usage:http://technet.microsoft.com/en-us/magazine/dd547066.aspxUnderstanding Mailbox Access Auditing with Exchange Server 2007 Service Pack 2:http://technet.microsoft.com/en-us/library/ee221156(EXCHG.80).aspx