Shared Mailbox Deleted by User

Copper Contributor

Hi,

 

Recently we will like to investigate who is the user that had deleted a shared mailbox.

 

Can i know what cmdlet to captured the logs? 

 

Thanks

3 Replies
Is this for on-premises or Exchange Online? Generally speaking, you need to check the Exchange Admin Audit log and/or the Unified Audit log in Office 365. You will also need to cover the "AD" part, as they might have deleted the user object directly.
@VasilMichev Thanks for reply. It will be EXO. Can you advise if any cmdlets to extract the information on who deleted the shared calendar?
Use this cmdlet to run a search against the Unified audit log:

Search-UnifiedAuditLog -EndDate (Get-Date) -StartDate (Get-Date).AddDays(-90) -Operation "Remove-Mailbox"

As mentioned above, you will likely need to cover some additional operations, such as "Delete user.". Check the documentation for more details: https://docs.microsoft.com/en-us/microsoft-365/compliance/search-the-audit-log-in-security-and-compl...