Exchange Mailbox Audit Log Event ID 25006

SourceExchange (LOGbinder EX)
LogMailbox Audit
Windows Security Log
Category
 • Subcategory
Object Access
 • Application Generated
Type Success
Failure
Discussions on Event ID 25006
Ask a question about this event

25006: Operation Move - Move item to another Exchange mailbox folder

This is an event from Exchange audit event from LOGbinder EX generated by Log  Mailbox Audit.

On this page

Exchange Move action.

Free Security Log Resources by Randy

Description Fields in 25006

Field Description
Occurred Date and time when Exchange registered the cmdlet.
Operation Operation performed on the mailbox.
Result Result of the operation:
  • Failed
  • PartiallySucceeded
  • Succeeded
Originating server The host name of the server.
Mailbox GUID Destination of move or copy (if applicable) - Mailbox's Globally Unique Identifier.
Mailbox owner Mailbox user resolved name in the format DOMAIN\SamAccountName.
Mailbox owner UPN Destination of move or copy (if applicable) - Mailbox owner's User Principal Name.
Mailbox owner SID Destination of move or copy (if applicable) - Mailbox owner's SID (Security Identifier).
Folder ID ID of affected folder (if applicable).
Folder name Name of affected folder (if applicable).
Performed user name Display name of the user who performed the operation.
Performed user SID SID of the user who performed the operation.
Performed logon type Logon type of the user who performed the operation. Logon types include:
  • Owner
  • Delegate
  • Admin
Client info Details that identify which client or Exchange component performed the operation.
Client IP address IP address of the client (e.g. Outlook).
Client process name Process name of the client application as reported by the client
Client version Version of the client application as reported by the client.
Destination folder ID Destination of move or copy (if applicable) - folder's ID.
Destination folder name Destination of move or copy (if applicable) - folder's name.
Items Item(s) affected by operation.
Additional information Additional information, if any (otherwise "n/a").

Setup PowerShell Audit Log Forwarding in 4 Minutes

 

Where Does This Event Come From?

This Event Is Produced By

Which Integrates with Your SIEM

Examples of 25006

Move item to another Exchange mailbox folder
Occurred: 1/20/2013 4:47:31 AM
Operation: Move
Result: Succeeded
Originating server: SP2010-EX1 (14.02.0328.009)
Mailbox
  GUID: d74d840c-4dff-4d73-bd8c-5b7a6ce254fd
  Owner: n/a
  Owner UPN: Jack.Striker@sp2010.com
  Owner SID: S-1-5-21-2141518605-3280587107-2299868870-1113
Folder
  ID: LgAAAADhmB/WGtj9QJHQYGoruww9AQB73FvAgkdWRYw1hL/iqQFMAAAAJaFEAAAB
  Folder: \Inbox
Performed By
  User name: Administrator
  User SID: S-1-5-21-2141518605-3280587107-2299868870-500
  Logon type: Owner
Client
  Info: Client=WebServices;UserAgent=OwaProxy
  IP address: 10.42.1.36
  Process name: n/a
  Version: n/a
Destination Folder
  ID: LgAAAACU/6drttwpRpk7rpQBqwiWAQB2IQyARlr2Rb5
WUIGWRjQaAAAjvPzYAAAB
  Folder: \bogus mails
Items:
Additional information: Owner= [Jack Striker]; LastAccessed= [2013-01-20T04:47:31.820618-05:00]; LogonType= [Delegate]; DestMailboxOwnerUPN= [Administrator@sp2010.com]; DestMailboxOwnerSid= [S-1-5-21-2141518605-3280587107-2299868870-500]; DestMailboxGuid= [9db94f90-97cb-425d-b6c8-48200020026f]; CrossMailboxOperation= [true]; SourceItems/Item/Id= [ RgAAAADhmB/WGtj9QJHQYGoruww9BwB73FvAgkdWRYw1hL/iqQFMAAAAJaFEAAB73Fv
AgkdWRYw1hL/iqQFMAAAjcMzFAAAJ]; SourceItems/Item/Subject= [ RE: Send on behalf of Jack]; SourceItems/Item/FolderPathName= [ \Inbox]

For more information, see http://logbinder.com/support

Keep me up-to-date on the Windows Security Log.
Email*:
*We will NOT share this

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection



 

Additional Resources