Beginning with Exchange 2007 the Exchange database has had an internal table called EventHistory. This table has been used to track the events upon which several of the assistants are based and fo...
Updated Jul 01, 2019
Version 2.0
Blog Post
Great article! Very helpful! I actually just needed to use this to figure out who disconnected a mailbox and it worked perfectly. Not to sound unappreciative of this blog post, but are there any plans on creating a TechNet article for the Get-DatabaseEvent cmdlet in order to see what the possible properties are, such as the different values of the EventName property?
FYI - When running this in the Exchange 2007 Management Shell, it didn't recognize the -MailboxGuid parameter, so I had to add that to the where filter instead:
Get-DatabaseEvent $db -resultsize unlimited | ? {$_.documentid -ne 0 -and $_.CreateTime -ge “<mm/dd/yyyy>” -and $_.MailboxGuid -eq $mb} | fl > c:tempEventHistory.txt
Thanks!
-Cory