The Hex Number explanation is extremely helpful. Thanks!
-----Original Message-----
From: Mark Harford [mailto:[EMAIL PROTECTED]]
Sent: Thursday, August 23, 2001 10:43 AM
To: Exchange Discussions
Subject: RE: Mailbox Creation/Deletion
Have the logging level for the Directory Access object of the Directory
Service set to maximum. This means that any change to an object in the
directory will be logged with an event.
The event is always from MSExchangeDS with ID number 1172. The User is the
NT login ID of the user who made the change. The Description contains the
Directory Name of the object that was modified and the hex number for the
rights required shows what action was performed. There is no list of what
means what but this is what we have found.
0x10000 Delete
0x80 Add/Modify NT account permisions
0x82 Remove NT account from Permisions
0x4 Change Admin attributes (This includes hideing/un-hideing
from the GAL) It also includes changing the display name.
0x2 Change User attributes
0x1 Create
N.B. The event is logged on the server that Exchange Admin is connected to
not the server where the mailbox is homed.
Rgrds
Mark
-----Original Message-----
From: McCready, Robert [mailto:[EMAIL PROTECTED]]
Sent: 23 August 2001 14:39
To: Exchange Discussions
Subject: Mailbox Creation/Deletion
We have a user who lost all of the mail in his mailbox, including personal
folders/contacts, etc. I believe what happened is that one of the Exchange
Admins accidentally deleted that mailbox and then recreated it. I did open
the users mailbox, and find that it was just created Tuesday of this week.
Is there any way to find out who created this mailbox or deleted the old
one? I checked EVENTVWR, didn't see anything.
Thanks!
Robert
*** CONFIDENTIALITY NOTICE ***
This electronic mail message and any attachments to this electronic mail
message contain confidential information belonging to the originator, and
may be attorney client privileged or constitute inside information. It is
intended only for the use of the individual(s) listed as the recipient(s).
If you are not one of the intended recipient(s), you are hereby notified
that any disclosure, copying, distribution, or the taking of any action in
reliance on the contents of the electronically mailed information is
strictly prohibited. If you have received this electronic mail message in
error, please forward the electronic mail message to [EMAIL PROTECTED] and
then remove all traces of the electronic mail message from your system.
*** The Dayton Power & Light Company. ***
_________________________________________________________________
List posting FAQ: http://www.swinc.com/resource/exch_faq.htm
Archives: http://www.swynk.com/sitesearch/search.asp
To unsubscribe: mailto:[EMAIL PROTECTED]
Exchange List admin: [EMAIL PROTECTED]
This e-mail, and any attachment, is confidential. If you have received
it in error, please delete it from your system, do not use or disclose
the information in any way, and notify me immediately. The contents of
this message may contain personal views which are not the views of the
BBC, unless specifically stated.
_________________________________________________________________
List posting FAQ: http://www.swinc.com/resource/exch_faq.htm
Archives: http://www.swynk.com/sitesearch/search.asp
To unsubscribe: mailto:[EMAIL PROTECTED]
Exchange List admin: [EMAIL PROTECTED]
_________________________________________________________________
List posting FAQ: http://www.swinc.com/resource/exch_faq.htm
Archives: http://www.swynk.com/sitesearch/search.asp
To unsubscribe: mailto:[EMAIL PROTECTED]
Exchange List admin: [EMAIL PROTECTED]
