Exchange Mailbox Audit Log Event ID 25001

25001: Operation Copy - Copy item to another Exchange mailbox folder

This is an event from Exchange audit event from LOGbinder EX generated by Log  Mailbox Audit.

On this page

• Description of this event
• Field level details
• Examples

Exchange Copy action.

This event is not logged for logon type: Delegate, Owner.

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Description Fields in 25001

Field	Description
Occurred	Date and time when Exchange registered the cmdlet.
Operation	Operation performed on the mailbox.
Result	Result of the operation: Failed PartiallySucceeded Succeeded
Originating server	The host name of the server.
Mailbox GUID	Destination of move or copy (if applicable) - Mailbox's Globally Unique Identifier.
Mailbox owner	Mailbox user resolved name in the format DOMAIN\SamAccountName.
Mailbox owner UPN	Destination of move or copy (if applicable) - Mailbox owner's User Principal Name.
Mailbox owner SID	Destination of move or copy (if applicable) - Mailbox owner's SID (Security Identifier).
Folder ID	ID of affected folder (if applicable).
Folder name	Name of affected folder (if applicable).
Performed user name	Display name of the user who performed the operation.
Performed user SID	SID of the user who performed the operation.
Performed logon type	Logon type of the user who performed the operation. Logon types include: Owner Delegate Admin
Client info	Details that identify which client or Exchange component performed the operation.
Client IP address	IP address of the client (e.g. Outlook).
Client process name	Process name of the client application as reported by the client
Client version	Version of the client application as reported by the client.
Destination mailbox GUID	Destination of move or copy (if applicable) - Mailbox's Globally Unique Identifier.
Destination mailbox owner UPN	Destination of move or copy (if applicable) - Mailbox owner's User Principal Name.
Destination mailbox owner SID	Destination of move or copy (if applicable) - Mailbox owner's SID (Security Identifier).
Destination folder ID	Destination of move or copy (if applicable) - folder's ID.
Destination folder name	Destination of move or copy (if applicable) - folder's name.
Items	Item(s) affected by operation.
Additional information	Additional information, if any (otherwise "n/a").

Setup PowerShell Audit Log Forwarding in 4 Minutes

 

 

Upcoming Webinars The Advantages and Limitations of MFA: A Look into Common Bypass Techniques and Security Counter Measures

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy