Event Details
User Activity->Permission Changes->Exchange Object Permission Changes->InTrust Plug-in for Exchange->Owner Permissions Changes->EventID 211 - User removed a delegate for own mailbox.
EventID 211 - User removed a delegate for own mailbox.
 Sample:
Event Type:     SuccessAudit
Event Source:   InTrust for Exchange
Event Category: Permissions change
Event ID:       211
Date:           11/9/2009
Time:           09:06:29
User:           RESEARCH\DKrane
Computer:       DC1
Description:    
User removed a delegate for own mailbox:

	User Name: DKrane 

	User Domain: research.corp 

	Mailbox Name: Daniel Krane 

	Mailbox legacyExchangeDN: /o=Research corp/ou=First Administrative Group/cn=Recipients/cn=DKrane 

	Client IP: 10.0.0.2 

	Delegate: ALebovsky 

	Delegation was removed for the following items: 

		Calendar: Editor 

		Tasks: None 

		Inbox: Editor 

		Contacts: Editor 

		Notes: Editor 

		Journal: Editor 

	Options

		Delegate can see private items: disabled 
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: InTrust for Exchange
Filtering Field Equals to Value
Category ITEX:Permissions change
Source InTrust for Exchange
EventId 211
Field Matching
FieldDescriptionStored inSample Value
When At what date and time a user activity originated in the system. DateTime 10.10.2000 19:00:00
Who Account or user name under which the activity occured. User Name ALebovsky
What The type of activity occurred (e.g. Logon, Password Changed, etc.) "Exchange mailbox delegate removed" Exchange mailbox delegate removed
Where The name of the workstation/server where the activity was logged. Computer DC1
Where From The name of the workstation/server where the activity was initiated from. Client IP 10.0.0.1
Severity Specify the seriousness of the event. "High" High
WhoDomain -
WhereDomain -
Object Type The type of object whose permissions were changed (e.g. AD object, file, registry, etc.) "Mailbox" Mailbox
Object Name The name of the object whose permissions were changed (e.g. full system path to the file or folder) Mailbox Name Daniel Krane
To Whom Account whose access permissions to the object were changed Delegate ALebovsky
Comments
You must be logged in to comment