Hi everyone, Our MB server is running on Exchange 2007 SP2 with RU4. And CAS servers have already installed SP3 with RU1. The OS of all these servers are Windows 2003 R2. Recently, some of our users reported that their calendar events were somehow, without their knowledge (so they suspect there are technical issues), modified by themselves. And we are asked to find out from which email clients (Outlook, Entourage, iCal, ActiveSync of iPhone or iPad, etc.) these modifications were made. We are preparing to turn on the Mailbox Access Auditing on the MB server. Here are my questions (while reading the “White Paper: Configuration and Mailbox Access Auditing for Exchange 2007 Organization”). - Are we able to use Mailbox Access Auditing to track down which email client changed a Calendar event by comparing the time and who made the last modification? - If yes, what Auditing Logging Level we should use for MSExchangeIS -> 9000 Private -> Message Access (I hope this is the right place And my questions to all the admins who already implemented Mailbox Access Auditing are: - What kind of performance impacts do you notice? - Any other issues (other than the one mentioned in KB977261, which were resolved in SP2 RU1)? Thanks in advance. Eric