Exchange 2010 - Admin audit log query

[Navishkar Sadheo]

Hi All

Wonder if someone could possibly assist me with a query. In Exchange 2010 Admin audit logging, does it log when admin audit logging is turned off or back on?

Reason for my question is that an exchange admin could turn admin audit logging off, makes some changes and turn it back on again.

Appreciate any feedback

[#2 · Accepted solution]

Hello Navishkar,

I do not think the exchanged audit log itself shows an enable/disable in the logs, but if you run Get-AdminAuditLogConfig, it will show you a created date, here is an example of an output from that:

As you can see with the when created date, I would just check your logs as you see fit, and if you think there is a discrepancy, come back and look to see the start date. By default the logs are held for 90 days.

Adam

[#3]

@Adam Ochs Thanks for that advice bud.

#appreciate

[#4]

Happy to help, us Exchange guys have to stick together ;)