No, it's not enabled by default. The audit logs are stored as part of the mailbox and can significantly increase the size of a mailbox database if all mailboxes are enabled.
You can take it from me - Exchange will never delete anything without you telling it to. :) From: [email protected] [mailto:[email protected]] On Behalf Of J- P Sent: Friday, May 22, 2015 9:37 AM To: Exchange List Subject: RE: [Exchange] Proving deleted messages from outlook Thanks, I know by default EX2013 has a gazillion logs enabled by default, is mailbox audit logging one of them? thanks again ________________________________ From: [email protected]<mailto:[email protected]> To: [email protected]<mailto:[email protected]> Subject: RE: [Exchange] Proving deleted messages from outlook Date: Fri, 22 May 2015 13:27:24 +0000 Mailbox audit logging has to be enabled. Otherwise, no. From: [email protected]<mailto:[email protected]> [mailto:[email protected]] On Behalf Of J- P Sent: Thursday, May 21, 2015 11:11 PM To: Exchange List Subject: [Exchange] Proving deleted messages from outlook Hi all, A user sent me a message saying "all my messages prior to this afternoon have disappeared" I logged in as the user , went to the inbox, went to "recover deleted items" and all the messages showed deleted today at 3:45pm, I easily recovered them, and informed the user that either she, or someone with access to the mailbox, deleted the messages. Aside from me seeing them there, is there a log, or eventID I can show the manager that these messages were deleted ? and they didn't just "disappear"
