Administrator Audit Logging in Exchange Server 2010

Administrator Audit Logging allows you to log Cmdlets that have been executed to make changes in the Exchange Organization. This is based on the fact that the cmdlets has been run in the Shell but actually it's Exchange Management Console which is running these cmdlets.

One important point to remember is that cmdlets starting with Get- are not logged.

Run the below command to check parameters associated with Administrator Audit logging cmdlets:-

Get-AdminAuditLogConfig | fl *log*

· AdminAuditLogEnabled default value is set to false which means Administrator Audit Logging is disabled. Set this parameter to true to enable this feature.

· TestCmdletLoggingEnabled default value is set to false which means logging of Test-cmdlets is disabled.

· AdminAuditLogCmdlets default value is set to * which means it will log all cmdlets.

· AdminAuditLogParameters default value is set to * which means to log Cmdlets parameters also.

· AdminAuditLogAgeLimit feature has not been yet implemented. This feature will control how long log entries will be kept.

· AdminAuditLogMailbox parameter will use this mailbox to store the logged results.

Example:-

Let us see how we can configure mailbox setting that will be used for logged results.

Set-AdminAuditLogConfig -AdminAuditLogMailbox webmaster@techpeoples.net