Q:

Public Folder Contacts - Exchange 2010

So we are running Exchange 2010 and have a public folder containing thousands of contacts. Recently, someone created 10,000 duplicates but we don't know who.
My question is, is there a way to tell who created these contacts via the powershell or EMC?
Thanks

A:

Ah, it seems that it's [mostly] not possible.  And certainly not after the fact.

The short answer is no.
Public folders exist within the exchange database, not active directory, so there is no way of tracking it via AD tools.

However, reading further, it seems that you can turn on Exchange auditing which may or may not provide useful information for the future.  (The link on that blog/article is dead, so I provided the Technet guide.)  You'd probably then want to parse the resulting log with a script for, in this case, the object creation event.
Not that it does much good after the fact, but for next time, it might help.

