Hello, We have a mailbox that 'Everyone' has full access to in the organization. Today it's inbox content has vanished as of 1pm, yet nobody claims to have deleted the content. I have two questions. FYI this is an exchange 2007 on SBS 2008 1) Can I find out which user in the domain deleted the email? If not now, is it possible in future to implement this? 2) Can I alter permissions for users to be able to read/reply but not delete mail from this mailbox? Thanks, Rob

Auditing will not log folder or message deletion only access. The blog below shows how to set up a read only mailbox. http://exchangeshare.wordpress.com/2009/07/07/how-to-setup-read-only-mailbox-in-exchange-20032007/James Chong MCITP | EA | EMA; MCSE | M+, S+ Security+, Project+, ITIL msexchangetips.blogspot.com