Shared Mailbox Deleted by User

%3CLINGO-SUB%20id%3D%22lingo-sub-2915674%22%20slang%3D%22en-US%22%3EShared%20Mailbox%20Deleted%20by%20User%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2915674%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERecently%20we%20will%20like%20to%20investigate%20who%20is%20the%20user%20that%20had%20deleted%20a%20shared%20mailbox.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECan%20i%20know%20what%20cmdlet%20to%20captured%20the%20logs%3F%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2915674%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EExchange%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2916071%22%20slang%3D%22en-US%22%3ERe%3A%20Shared%20Mailbox%20Deleted%20by%20User%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2916071%22%20slang%3D%22en-US%22%3EIs%20this%20for%20on-premises%20or%20Exchange%20Online%3F%20Generally%20speaking%2C%20you%20need%20to%20check%20the%20Exchange%20Admin%20Audit%20log%20and%2For%20the%20Unified%20Audit%20log%20in%20Office%20365.%20You%20will%20also%20need%20to%20cover%20the%20%22AD%22%20part%2C%20as%20they%20might%20have%20deleted%20the%20user%20object%20directly.%3C%2FLINGO-BODY%3E
New Contributor

Hi,

 

Recently we will like to investigate who is the user that had deleted a shared mailbox.

 

Can i know what cmdlet to captured the logs? 

 

Thanks

3 Replies
Is this for on-premises or Exchange Online? Generally speaking, you need to check the Exchange Admin Audit log and/or the Unified Audit log in Office 365. You will also need to cover the "AD" part, as they might have deleted the user object directly.
@Vasil Michev Thanks for reply. It will be EXO. Can you advise if any cmdlets to extract the information on who deleted the shared calendar?
Use this cmdlet to run a search against the Unified audit log:

Search-UnifiedAuditLog -EndDate (Get-Date) -StartDate (Get-Date).AddDays(-90) -Operation "Remove-Mailbox"

As mentioned above, you will likely need to cover some additional operations, such as "Delete user.". Check the documentation for more details: https://docs.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compl...