Exchange Mailbox Audit Log Event ID 25006
25006: Operation Move - Move item to another Exchange mailbox folder
This is an event from
Exchange
audit event from
LOGbinder EX
generated by
.
On this page
Exchange Move action.
Free Security Log Resources by Randy
| Field |
Description |
| Occurred |
Date and time when Exchange registered the cmdlet. |
| Operation |
Operation performed on the mailbox. |
| Result |
Result of the operation:
- Failed
- PartiallySucceeded
- Succeeded
|
| Originating server |
The host name of the server. |
| Mailbox GUID |
Destination of move or copy (if applicable) - Mailbox's Globally Unique Identifier. |
| Mailbox owner |
Mailbox user resolved name in the format DOMAIN\SamAccountName. |
| Mailbox owner UPN |
Destination of move or copy (if applicable) - Mailbox owner's User Principal Name. |
| Mailbox owner SID |
Destination of move or copy (if applicable) - Mailbox owner's SID (Security Identifier). |
| Folder ID |
ID of affected folder (if applicable). |
| Folder name |
Name of affected folder (if applicable). |
| Performed user name |
Display name of the user who performed the operation. |
| Performed user SID |
SID of the user who performed the operation. |
| Performed logon type |
Logon type of the user who performed the operation. Logon types include:
|
| Client info |
Details that identify which client or Exchange component performed the operation. |
| Client IP address |
IP address of the client (e.g. Outlook). |
| Client process name |
Process name of the client application as reported by the client |
| Client version |
Version of the client application as reported by the client. |
| Destination folder ID |
Destination of move or copy (if applicable) - folder's ID. |
| Destination folder name |
Destination of move or copy (if applicable) - folder's name. |
| Items |
Item(s) affected by operation. |
| Additional information |
Additional information, if any (otherwise "n/a"). |
Supercharger Free Edition
Your entire Windows Event Collection environment on a single pane of glass.
Free.
This Event Is Produced By
Which Integrates with Your SIEM
Move item to another Exchange mailbox folder
Occurred: 1/20/2013 4:47:31 AM
Operation: Move
Result: Succeeded
Originating server: SP2010-EX1 (14.02.0328.009)
Mailbox
GUID: d74d840c-4dff-4d73-bd8c-5b7a6ce254fd
Owner: n/a
Owner UPN: Jack.Striker@sp2010.com
Owner SID: S-1-5-21-2141518605-3280587107-2299868870-1113
Folder
ID: LgAAAADhmB/WGtj9QJHQYGoruww9AQB73FvAgkdWRYw1hL/iqQFMAAAAJaFEAAAB
Folder: \Inbox
Performed By
User name: Administrator
User SID: S-1-5-21-2141518605-3280587107-2299868870-500
Logon type: Owner
Client
Info: Client=WebServices;UserAgent=OwaProxy
IP address: 10.42.1.36
Process name: n/a
Version: n/a
Destination Folder
ID: LgAAAACU/6drttwpRpk7rpQBqwiWAQB2IQyARlr2Rb5
WUIGWRjQaAAAjvPzYAAAB
Folder: \bogus mails
Items:
Additional information: Owner= [Jack Striker]; LastAccessed= [2013-01-20T04:47:31.820618-05:00]; LogonType= [Delegate]; DestMailboxOwnerUPN= [Administrator@sp2010.com]; DestMailboxOwnerSid= [S-1-5-21-2141518605-3280587107-2299868870-500]; DestMailboxGuid= [9db94f90-97cb-425d-b6c8-48200020026f]; CrossMailboxOperation= [true]; SourceItems/Item/Id= [ RgAAAADhmB/WGtj9QJHQYGoruww9BwB73FvAgkdWRYw1hL/iqQFMAAAAJaFEAAB73Fv
AgkdWRYw1hL/iqQFMAAAjcMzFAAAJ]; SourceItems/Item/Subject= [ RE: Send on behalf of Jack]; SourceItems/Item/FolderPathName= [ \Inbox]
For more information, see http://logbinder.com/support
Top 10 Windows Security Events to Monitor
Free Tool for Windows Event Collection