Audit when an email is deleted from a mailbox

[freeman642]

I have a situation where we have many people have access to a mailbox,
this mailbox every now and again has emails deleted and we dont know
who deletes them. We need everyone to have rights to delete them
because the mailbox will become unmanageable if we dont.

Is there a way using VBA that when an email is deleted from the
mailbox all I want to do is either write a line to a log file comma
delimited with like email_id, sender, and who the logged person was
who deleted it and what time and a few other things or update a
database.

We back the email up so it is easy to recover but it is very important
these things get actioned.

Any help grateful received.

Thanks John

 

[Eric Legault [MVP - Outlook]]

If these are delegated mailboxes, then you would need the code to run on each
of the computers for the users who are opening other people's mailboxes.
That's probably not going to happen in most environments...

Otherwise, you would need to develop an Exchange Event sink where the code
runs "silently" on the server 24/7, without client side code or needing
Outlook to be open. Sinks are for advanced programmers though.

 

[freeman642]

hi Eric, thanks for your answer. I can roll it out to each user thats
not a problem, where do I start? Can you point me in the right
direction as to what commands or code to use, I have monitored a
mailbox for new entries before, but no for deleting, is there an event
to call?

Thanks again, John

 

[Eric Legault [MVP - Outlook]]

Hi John. For easy deployment, you need to develop this solution as a COM
Add-In with Visual Studio:

Developing COM Add-ins for Microsoft Outlook:
http://www.outlookcode.com/article.aspx?ID=36

Your code need to work similar to the example here:

How to process incoming messages in Microsoft Outlook:
http://www.outlook-code.com/article.aspx?id=62

However, if you need to monitor more folders than the Inbox, you'll need to
wire up ItemRemove events for multiple folders - not to mention multiple
mailboxes if a user happens to have more than two open.

The more I think about this, the more I'm wondering how in the world we will
handle events firing on the *same folder in multiple locations*... If you're
diligent, coding your own solution may work, but I suspect a third-party
solution for auditing in Exchange may be more practical.