none
track users deletion in domain RRS feed

  • Question

  • hi all,

    when users deleted mail in their archived pst files , this deletion is loged in event log of microsoft 

    in microsoft office alerts 

    as follow 

    are you sure you want to delete the sected item 

    P1:301489

    P2:14.0.4763.1000

    how to collect these logs and know what users did to their archived pst files on their pc 

    note : that we don't have space on our storage so our policy that the user keep his archived mail in his pc 

    I already enabled auditaccountmanagement,auditdirectory service access,audit object access,audit policy change

    Tuesday, October 29, 2019 12:52 PM

All replies