Hi We have many shared mailboxes in our Exchange 2007 environment. One of these is HR (hr@mycompany.com). It seems someone has gone in and deleted a whole bunch of emails from there, whether on purpose or not I'm not sure. Is there any way to track who has done this? Or enable tracking of this sort? No one has direct access to the mailbox, it's always an additional mailbox in their Profile. I did have one thought - when a message from a secondary mailbox is deleted, which Deleted Items does it go to? The Primary or Secondary? For instance, if I had HR added as a secondary mailbox to my Profile, and I deleted some items, which Deleted Item would it go into (mine or HR's)? I was thinking along the lines of running a Powershell script on the deleted items of everyone who has Full Mailbox access to HR? Does anyone know how this would work and what I'd be searching for?

See this - http://social.technet.microsoft.com/Forums/en-US/exchangesvrsecuremessaging/thread/d70f1043-bca2-40ad-b712-63dc83b50ed9 - Check the links in here. If you havent enabled tracking, you can enable it now for future use. When the message is deleted it should go to the primay mailbox (if soft deleted). However you can still recover using the dumpster key and it will show in the folder where the message was. If it was hard deleted, then it will only show in the dumpster using the dumpster reg key. http://support.microsoft.com/kb/886205 If it was soft deleted and it;s still in your users deleted items folder then you may be able to run a PS script to find it, however, I think the user if done deliveratly would have deleted this too. If there aren't many users, look at each one's dumpster,may help. If the user hard deleted directly from the 2nd mailbox, then it wont show in their deleted items folder or dumpster. Sukh

Hi, Access Auditing does not audit message deletions, only message access. http://technet.microsoft.com/en-us/library/ee221156(EXCHG.80).aspx However you can find when the items are deleted. And then check who access the mailbox during the time. To recover a deleted item: http://technet.microsoft.com/en-us/library/aa997155(EXCHG.80).aspx You also need to check if the age of deleted items is in the retention period. In Exchange 2007, the default retention period is 14 days. http://technet.microsoft.com/en-us/library/bb125266(EXCHG.80).aspxPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.