SOLVED

Audit for Message Trace and Exchange managment shell commands

%3CLINGO-SUB%20id%3D%22lingo-sub-660959%22%20slang%3D%22en-US%22%3EAudit%20for%20Message%20Trace%20and%20Exchange%20managment%20shell%20commands%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-660959%22%20slang%3D%22en-US%22%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20there%20a%20way%20to%20run%20audits%20on%20which%20admin%20users%20ran%20message%20trace%20and%20Exchange%20online%20power%20shell%20commands%20(and%20what%20commands%20those%20are)%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThank%20you.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-660959%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EExchange%20Online%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-661256%22%20slang%3D%22en-US%22%3ERe%3A%20Audit%20for%20Message%20Trace%20and%20Exchange%20managment%20shell%20commands%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-661256%22%20slang%3D%22en-US%22%3E%3CP%3EMessage%20trace%20is%20not%20audited%2C%20neither%20are%20any%20of%20the%20Get-*%20cmdlets.%20All%20the%20others%20are%20audited%20and%20you%20can%20view%20them%20in%20the%20Unified%20audit%20log%20or%20the%20Exchange%20Admin%20Center%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fexchange%2Fsecurity-and-compliance%2Fexchange-auditing-reports%2Fview-administrator-audit-log%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fexchange%2Fsecurity-and-compliance%2Fexchange-auditing-reports%2Fview-administrator-audit-log%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Contributor

 

Is there a way to run audits on which admin users ran message trace and Exchange online power shell commands (and what commands those are)?

 

Thank you.

1 Reply
Highlighted
Best Response confirmed by Emy Loanzon (Contributor)
Solution

Message trace is not audited, neither are any of the Get-* cmdlets. All the others are audited and you can view them in the Unified audit log or the Exchange Admin Center: https://docs.microsoft.com/en-us/exchange/security-and-compliance/exchange-auditing-reports/view-adm...