Get-DatabaseEvent: Who deleted my items?

I just had an incident, where items got deleted. Of course, the affected person was a VIP and so I had to investigate the incident with high priority.

What happend?

The first issue was that items vanished from a shared mailbox. One day later items in the mailbox of the assistant also disappeared.

Due to all the issues in the past with mobile devices (and I knew they were using a lot of mobile devices), my first thought was those might caused the issue.

The challenge was not to get the items back (thanks to Single Item Recovery!). It was more to clearly identify the client, which deleted the items.

Thank Exchange PG for the CmdLet Get-DatabasEvent!

To get more details about this I really encourage you to read this article Adventures in querying the EventHistory table, which goes into all the details.

In my case I decided to look into those events, just to make sure we don’t have another issue with mobile devices.

First I collected the events and exported those into a CSV file:

Add-PSSnapin Microsoft.Exchange.Management.Powershell.Support
Get-Mailbox ingo.gegenwarth@contoso.com | select ExchangeGUID
$dbevents=Get-DatabaseEvent -MailboxGuid d5cfefb4-1a42-4a2d-9524-21a0074df42c -Server ex01.contoso.local -ResultSize unlimited | sort CreateTime
$dbevents | Export-Csv -NoTypeInformation -Path C:\Temp\dbdata.csv

GetDatabasEvent_01

Now I had all the data from the database. As the items has been deleted from the folder Inbox only, I needed to know the HexEntryID of this folder. Therefore I reused one of my scripts:

Get-MailboxFolderPermissionEWS.ps1

I wrote this script for a different purpose (here is the blog post), but I had to extend the script with very little effort to get also the HexEntryID. Read more about EWS Identifiers here.

.\Get-MailboxFolderPermissionEWS.PS1 -EmailAddress ingo.gegenwarth@contoso.com | ? FolderPath -EQ '\Inbox'

Note: Keep in mind that you either need FullAccess to the mailbox or ApplicationImpersonation permissions!
This example shows the output:

GetDatabasEvent_02Now as I had the HexEntryID of the folder, I just had to import the CSV file into Excel.
As you can see there are a lot of columns, but the first one we are interesting in is OldParentEntryId

GetDatabasEvent_03

As the HexEntryID is the value of the ItemEntryID we now can easy filter the column for this value

GetDatabasEvent_04

At one point in time I could see that a lot of items got moved. I just had to look at the ClientCategory column

GetDatabasEvent_05

The ClientCategory was MOMT! All of the items have been deleted by an Outlook client.

Conclusion

In this case no mobile device was involved. But I thought this would be a good example to show how to trace such an issue.

By the way: The RC was a new device with touch screen and maybe some sticky fingers….

I hope this will help some of you!

Advertisements

6 thoughts on “Get-DatabaseEvent: Who deleted my items?

  1. Pingback: 获取邮箱目录权限 - Exchange中文站

    • Hi,
      you need to import the PSSnapin Microsoft.Exchange.Management.Powershell.Support:
      Add-PSSnapin Microsoft.Exchange.Management.Powershell.Support
      A full list of commands of this snapin could be retrieved with:
      Get-Command -Module Microsoft.Exchange.Management.Powershell.Support
      Makes sense?
      Ciao,
      Ingo

      Like

  2. Pingback: How to hunt down an EAS bug | The clueless guy

  3. Where can I find descriptions for other ClientCategory entries? Specifically EventBasedAssistants and TimeBasedAssistants.

    Thanks!

    Like

    • Hi Sally,
      I’m not aware of any documentation for Exchange assistants. In this area Technet is not very helpful. But if you have issues you can use these information to provide it to MS.
      Sorry!
      Ciao,
      Ingo

      Like

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s