![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
Exchange single mail transfer event search
Adventures in querying the EventHistory table
Beginning with Exchange 2007 the Exchange database has had an internal table called EventHistory. This table has been used to track the events upon which several of the assistants are based and for other short term internal record keeping. The way to query the table hasn’t been publicized before but it has a number of uses:
It may tell you the fate of a deleted item (for situations where Audit logging or store tracing was not in place at the time of the delete)
It can list accounts who have recently touched a mailbox
It can show you the clients that have touched a mailbox
https://techcommunity.microsoft.com/t5/exchange-team-blog/adventures-in-querying-the-eventhistory-table/ba-p/593244
OR:
Mailbox audit logging in Exchange Server
Adventures in querying the EventHistory table
Beginning with Exchange 2007 the Exchange database has had an internal table called EventHistory. This table has been used to track the events upon which several of the assistants are based and for other short term internal record keeping. The way to query the table hasn’t been publicized before but it has a number of uses:
It may tell you the fate of a deleted item (for situations where Audit logging or store tracing was not in place at the time of the delete)
It can list accounts who have recently touched a mailbox
It can show you the clients that have touched a mailbox
https://techcommunity.microsoft.com/t5/exchange-team-blog/adventures-in-querying-the-eventhistory-table/ba-p/593244
OR:
Mailbox audit logging in Exchange Server
