Exchange Mailbox Audit Log Event ID 25000

25000: Undocumented Exchange mailbox operation

This is an event from Exchange audit event from LOGbinder EX generated by Log  Mailbox Audit.

On this page

• Description of this event
• Field level details
• Examples
• Mini-seminars on this event

This is event will be generated if an undocumented Exchange event is reported.

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Description Fields in 25000

Field	Description
Occurred	Date and time when Exchange registered the cmdlet.
Operation	Operation performed on the mailbox.
Result	Result of the operation: Failed PartiallySucceeded Succeeded
Originating server	The host name of the server.
Mailbox GUID	Destination of move or copy (if applicable) - Mailbox's Globally Unique Identifier.
Mailbox owner	Mailbox user resolved name in the format DOMAIN\SamAccountName.
Mailbox owner UPN	Destination of move or copy (if applicable) - Mailbox owner's User Principal Name.
Mailbox owner SID	Destination of move or copy (if applicable) - Mailbox owner's SID (Security Identifier).
Folder ID	ID of affected folder (if applicable).
Folder name	Name of affected folder (if applicable).
Performed user name	Display name of the user who performed the operation.
Performed user SID	SID of the user who performed the operation.
Performed logon type	Logon type of the user who performed the operation. Logon types include: Owner Delegate Admin
Client info	Details that identify which client or Exchange component performed the operation.
Client IP address	IP address of the client (e.g. Outlook).
Client process name	Process name of the client application as reported by the client
Client version	Version of the client application as reported by the client.
Additional information	Additional information, if any (otherwise "n/a").

Supercharger Enterprise

 

 

Upcoming Webinars Unpacking a Linux Supply Chain Compromise Using the Recently Published XZ Utils Backdoor as the Example Assessing the Security of Your Active Directory: User Accounts Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy