You configure audit logging with the Set-AdminAuditLogConfig cmdlet. If you don't want to audit every cmdlet that's run, you can configure audit logging to audit only the cmdlets and parameters you're interested in. If a command doesn't appear in the administrator audit log, wait a few minutes and run the search again.īy default, when admin audit logging is enabled, a log entry is created every time any cmdlet is run. This is because audit log entries must be indexed before they can be searched. If you want to apply the changes immediately, close and then open the Exchange Management Shell again on each computer.Ī command may take up to 15 minutes after it's run to appear in audit log search results. For more information, see the Admin Audit Log agent section later in this topic.Ĭhanges to the audit log configuration are refreshed every 60 minutes on computers that have the Exchange Management Shell open at the time a configuration change is made. If an error occurs after the Admin Audit Log agent is called, the cmdlet is logged along with the associated error.
Audit logging is intended to show what actions have been taken to modify objects in an Exchange organization rather than what objects have been viewed.Ī cmdlet might not be logged if an error occurs before the cmdlet calls the Admin Audit Log cmdlet extension agent. In addition, operations performed using the Exchange admin center (EAC) are also logged because those operations run cmdlets in the background.Ĭmdlets, regardless of where they're run, are audited if a cmdlet is on the cmdlet auditing list and one or more parameters on that cmdlet are on the parameter auditing list. What gets auditedĬmdlets that are run directly in the Exchange Management Shell are audited. By keeping a log of the changes, you can trace changes to the person who made the change, augment your change logs with detailed records of the change as it was implemented, comply with regulatory requirements and requests for discovery, and more.īy default, administrator audit logging is enabled in new installations of Exchange Server. You can use administrator audit logging in Exchange Server to log when a user or administrator makes a change in your organization.
0 kommentar(er)
