Diagnostic Logging to find Deletion of Public folder in Exchange 2007 and Exchange 2010

 

Many users will have access to the Public Folder and Many are the owner of Public folder and have full access to it. Chances are that use accidently deletes the folder or some times intentional. To identify this we have to Enable logging on Public folder.  Below has the steps to enabled the same

1. Open Exchagne Management Console
2. Expand and select Server Configuration
3. On the right you will find all the servers
4. Select the Exchange Server where public Folder Database is residing
5. Right click on the Server and select Manage Diagnostic Logging
5. Expand to reach MSexchangeIS-> 9001 public and click on General and  
6. Select Medium and configure to enable this settings

7. When a Public Folder is deleted Event ID 9682 is logged in the Application log. You can search for the evet Id in the application logs.

4 thoughts on “Diagnostic Logging to find Deletion of Public folder in Exchange 2007 and Exchange 2010

  1. Pingback: Managing Public Folders in Microsoft Exchange Server 2007 | Monir's Blog

  2. How do you match the folder ID’s from the eventlog to actual PF names
    the eventlog says: Folder with folder ID 1-35D424F5 is deleted by ….

    the only way I can think of that lists the folder Id’s is:
    Get-PublicFolder “publicfolderpath” -GetChildren | Select-Object name,EntryId | fl

    but that doesn’t show the entries for deleted public folders.
    and if you restore the public folder (with exfolders) it has a different ID when you run get-publicfolder on it again.

  3. Hmmm, interesting, but in my case I don’t get that EventID when I delete a PF.
    Which is a shame since wheat you posted sounded like exactly what I needed…

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s