Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 2 down vote favorite

So we are running Exchange 2010 and have a public folder containing thousands of contacts. Recently, someone created 10,000 duplicates but we don't know who.

My question is, is there a way to tell who created these contacts via the powershell or EMC?

Thanks

share|improve this question

1 Answer

up vote 0 down vote accepted

Ah, it seems that it's [mostly] not possible. And certainly not after the fact.

The short answer is no.

Public folders exist within the exchange database, not active directory, so there is no way of tracking it via AD tools.

However, reading further, it seems that you can turn on Exchange auditing which may or may not provide useful information for the future. (The link on that blog/article is dead, so I provided the Technet guide.) You'd probably then want to parse the resulting log with a script for, in this case, the object creation event.

Not that it does much good after the fact, but for next time, it might help.

share|improve this answer
Sorry? I am confused an Exchange public folder is not the AD. – Zoredache Jul 31 '12 at 18:03
@Zoredache Doi, thanks. It's evn in the title and I still missed that detail. I'll check that out in my test environment and edit/delete this as appropriate. – HopelessN00b Jul 31 '12 at 18:13
Thanks guys for the response! Let me know if you find anything. – user111503 Jul 31 '12 at 20:20
@user111503 I was able to get useful information from the logs once I turned out Exchange auditing... but only after the auditing was turned on. For events that occurred prior to increasing the logging data, the information you're looking for simply isn't recorded anywhere. So you're out of luck as it pertains to finding out who did something before you turn on auditing. But if you turn on auditing, you'll be able to track it down if it happens in the future. (It's almost definitely a script or tool that went haywire, FWIW, and you can at least track down who it's running as and when.) – HopelessN00b Jul 31 '12 at 20:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.