track users deletion in domain RRS feed

  • Question

  • hi all,

    when users deleted mail in their archived pst files , this deletion is loged in event log of microsoft 

    in microsoft office alerts 

    as follow 

    are you sure you want to delete the sected item 



    how to collect these logs and know what users did to their archived pst files on their pc 

    note : that we don't have space on our storage so our policy that the user keep his archived mail in his pc 

    I already enabled auditaccountmanagement,auditdirectory service access,audit object access,audit policy change

    Tuesday, October 29, 2019 12:52 PM

All replies