Forum Discussion
Navishkar Sadheo
Aug 22, 2018Steel Contributor
Exchange 2010 - Admin audit log query
Hi All
Wonder if someone could possibly assist me with a query. In Exchange 2010 Admin audit logging, does it log when admin audit logging is turned off or back on?
Reason for my question is that an exchange admin could turn admin audit logging off, makes some changes and turn it back on again.
Appreciate any feedback
Hello Navishkar,
I do not think the exchanged audit log itself shows an enable/disable in the logs, but if you run Get-AdminAuditLogConfig, it will show you a created date, here is an example of an output from that:As you can see with the when created date, I would just check your logs as you see fit, and if you think there is a discrepancy, come back and look to see the start date. By default the logs are held for 90 days.
Adam
- Adam OchsSteel Contributor
Hello Navishkar,
I do not think the exchanged audit log itself shows an enable/disable in the logs, but if you run Get-AdminAuditLogConfig, it will show you a created date, here is an example of an output from that:As you can see with the when created date, I would just check your logs as you see fit, and if you think there is a discrepancy, come back and look to see the start date. By default the logs are held for 90 days.
Adam
- Navishkar SadheoSteel Contributor
- Adam OchsSteel Contributor
Happy to help, us Exchange guys have to stick together ;)