Shared Mailbox Deleted by User

[lgtyar]

Hi,

Recently we will like to investigate who is the user that had deleted a shared mailbox.

Can i know what cmdlet to captured the logs? 

Thanks

[#2]

Is this for on-premises or Exchange Online? Generally speaking, you need to check the Exchange Admin Audit log and/or the Unified Audit log in Office 365. You will also need to cover the "AD" part, as they might have deleted the user object directly.

[#3]

@Vasil Michev Thanks for reply. It will be EXO. Can you advise if any cmdlets to extract the information on who deleted the shared calendar?

[#4]

Use this cmdlet to run a search against the Unified audit log:

Search-UnifiedAuditLog -EndDate (Get-Date) -StartDate (Get-Date).AddDays(-90) -Operation "Remove-Mailbox"

As mentioned above, you will likely need to cover some additional operations, such as "Delete user.". Check the documentation for more details: https://docs.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compl...