track users deletion in domain

  • Thread starter Thread starter om zeyad
  • Start date Start date
O

om zeyad

Guest
hi all,

when users deleted mail in their archived pst files , this deletion is loged in event log of microsoft

in microsoft office alerts

as follow

are you sure you want to delete the sected item

P1:301489

P2:14.0.4763.1000

how to collect these logs and know what users did to their archived pst files on their pc

note : that we don't have space on our storage so our policy that the user keep his archived mail in his pc

I already enabled auditaccountmanagement,auditdirectory service access,audit object access,audit policy change

Continue reading...
 
Back
Top