There are ten employees at my workplace, each with a PC loaded with Outlook. We can all access each others' emails via the exchange server. I've recently discovered that only the most important emails are being deleted from my inbox before I've had a chance to read them. The rest appear to have been left undisturbed. I suspect foul play. Is there any way to discover who has been deleting my emails? I have the dates and times of three of these emails as the original senders had to resend. Also, I know that these emails got into the building because people in the cc list received them. Any advice greatly appreciated.

Who else has full permissions to your inbox. I Would start there. What version of Exchange and service pack?

7 of the staff.

It's 2003 version I think

U must have applied some rules.Plse check the folders in ur inbox. -bpara

OK, I would argue that 7 people do not need full access to your inbox. If they have full mailbox permissions, remove that and give them only reviewer delegate permissions to the folders they need to view only. Is there a business requirement that they have full access?

The managing director says that everybody should be able to check everybody else's emails in case a customer phones about an unanswered email because someone is on leave or off sick. I think it's a bit over the top myself but he got the IT people in to give full mutual permissions to seven staff. It kind of works until emails surreptitiously go walkies. What I'm more concerned about is finding out who is deleting them. Is there any suggestion you could make which I can pass on to the IT fellas about this. For instance, is there a log file on the exchange server which records who deleted emails?

On Fri, 20 Aug 2010 17:38:39 +0000, Class of the Curious wrote: >The managing director says that everybody should be able to check everybody else's emails in case a customer phones about an unanswered email because someone is on leave or off sick. I think it's a bit over the top myself but he got the IT people in to give full mutual permissions to seven staff. It kind of works until emails surreptitiously go walkies. What I'm more concerned about is finding out who is deleting them. Is there any suggestion you could make which I can pass on to the IT fellas about this. For instance, is there a log file on the exchange server which records who deleted emails? NO, but the messages will either be in the folder from which they were hard-deleted, or in the deleted items folder of the person that deleted them. If you have deleted item recovery set to some reasonable value, and the person that deleted the messages hasn't removed them from the dumster, they should be able to recover them. --- Rich Matheisen MCSE+I, Exchange MVP --- Rich Matheisen MCSE+I, Exchange MVP

and FWIW, upgrading to Exchange 2010 can help as SP1 will include enhanced mailbox auditing.

Thanks to all for your help. Alas, it looks like the phantom email deleter has got away with it - for now.

You can ask IT staff to increase the diagnostic logging on 'logon' and 'Access Control’ under the MSExchangeIS/Mailbox. After that, there will be event 1009 or 1013 or 1016 or 1029 or all will appears in the application log The description of these events tells us about the account who login on a mailbox or access any folder like the calendar, inbox etc. But these events don’t give the information about the modification of the items in the mailbox or items in the folders of the mailbox Since you know when the message reached mailbox, you can list all people who accessed the mailbox in the eventJames Luo TechNet Subscriber Support (http://technet.microsoft.com/en-us/subscriptions/ms788697.aspx) If you have any feedback on our support, please contact tngfb@microsoft.com