Thank you. Is there any way to see which administrator
it was. We unfortunately do not have logging enabled of
any sort on the DCs. I have seen when the account was
created and when the mailbox was created on the Exchange
server, but can not find the name of theuser that created
it.
Nope, if created by an administrator the ACLs will get stamped with
administrator / domain admins. You have to fall back to auditing but if you
don't have that on before the event, you can't go back and get the info.
