You can use the Exchange Management Shell to search the administrator audit logs and generate reports based on the cmdlets and parameters used to modify objects within your Exchange environment. Like mailbox audit log reports, we have two ways in which we can view the audit logs from the Exchange Management Shell, and in this recipe, we'll take a look at both the methods.
Let's see how to perform administrator audit log search using the following steps:
To perform a synchronous administrator audit log search in the shell, we can use the
Search-AdminAuditLogcmdlet. For example, after executing the following command, the following results will be displayed in the shell:Search-AdminAuditLog -Cmdlets Set-Mailbox ' -StartDate 5/1/2015 ' -EndDate 5/30/2015 ' -IsSuccess $true
This command will return all of the log entries for the
Set-Mailboxcmdlet for the month of May. Only the log entries from successful commands will be returned.