Forum Discussion

Navishkar Sadheo's avatar
Navishkar Sadheo
Steel Contributor
Aug 22, 2018

Exchange 2010 - Admin audit log query

Hi All

 

Wonder if someone could possibly assist me with a query. In Exchange 2010 Admin audit logging, does it log when admin audit logging is turned off or back on?

 

Reason for my question is that an exchange admin could turn admin audit logging off, makes some changes and turn it back on again.

 

Appreciate any feedback

  • Hello Navishkar,

    I do not think the exchanged audit log itself shows an enable/disable in the logs, but if you run Get-AdminAuditLogConfig, it will show you a created date, here is an example of an output from that:

     

     

    As you can see with the when created date, I would just check your logs as you see fit, and if you think there is a discrepancy, come back and look to see the start date. By default the logs are held for 90 days.

     

    Adam

  • Adam Ochs's avatar
    Adam Ochs
    Steel Contributor

    Hello Navishkar,

    I do not think the exchanged audit log itself shows an enable/disable in the logs, but if you run Get-AdminAuditLogConfig, it will show you a created date, here is an example of an output from that:

     

     

    As you can see with the when created date, I would just check your logs as you see fit, and if you think there is a discrepancy, come back and look to see the start date. By default the logs are held for 90 days.

     

    Adam

Resources