Exchange Mailbox Audit Log Event ID 25005

25005: Operation MessageBind - Access Exchange mailbox item

This is an event from Exchange audit event from LOGbinder EX generated by Log  Mailbox Audit.

On this page

• Description of this event
• Field level details
• Examples

Exchange MessageBind action.

This event is not logged for logon types: Delegate, Owner.

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Description Fields in 25005

Field	Description
Occurred	Date and time when Exchange registered the cmdlet.
Operation	Operation performed on the mailbox.
Result	Result of the operation: Failed PartiallySucceeded Succeeded
Originating server	The host name of the server.
Mailbox GUID	Destination of move or copy (if applicable) - Mailbox's Globally Unique Identifier.
Mailbox owner	Mailbox user resolved name in the format DOMAIN\SamAccountName.
Mailbox owner UPN	Destination of move or copy (if applicable) - Mailbox owner's User Principal Name.
Mailbox owner SID	Destination of move or copy (if applicable) - Mailbox owner's SID (Security Identifier).
Folder ID	ID of affected folder (if applicable).
Folder name	Name of affected folder (if applicable).
Performed user name	Display name of the user who performed the operation.
Performed user SID	SID of the user who performed the operation.
Performed logon type	Logon type of the user who performed the operation. Logon types include: Owner Delegate Admin
Client info	Details that identify which client or Exchange component performed the operation.
Client IP address	IP address of the client (e.g. Outlook).
Client process name	Process name of the client application as reported by the client
Client version	Version of the client application as reported by the client.
Item ID	ID of affected item (if applicable).
Item subject	Subject of affected item (if applicable).
Additional information	Additional information, if any (otherwise "n/a").

Supercharger Free Edition

 

 

Upcoming Webinars The Advantages and Limitations of MFA: A Look into Common Bypass Techniques and Security Counter Measures

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy