Link to home
Start Free TrialLog in
Avatar of Stéphane Boisvert
Stéphane BoisvertFlag for Canada

asked on

Who used Get-Messagetrackinglog powershell command

Hi
There a simply way to know if an administrator used the command Get-Messagetrackinglog ?
I search in the Windows Event Viewer but I didn't find anything

Thank you in advance
Avatar of Marwan Osman
Marwan Osman
Flag of Lebanon image

Actually you can audit using the exchange 2013 built-in audit reports who use cmdlets to change the exchange configuration, the cmdlets started with new-*** or set-*** or remove-****, but the cmdlets started with get-**** are not audited by these built-in reports.
Avatar of Stéphane Boisvert

ASKER

There no way to see it in the Windows Event Viewer ?
No, it is not writen in the event viewer, but I am still working on how to audit the get-***

I run :

Search-AdminAuditLog -StartDate "06/01/2015 07:00" -EndDate "06/01/2015 18:00" | Sort RunDate | Format-T
able RunDate, Caller, CmdletName, CmdletParameters -AutoSize

it shows the set-cmdlets and the remove-*** ......... but unfortunately not shown the cmdlets starting with get-
as in the below technet article, Get- and Search- cmdlets aren't logged. Audit logging is intended to show what actions have been taken to modify objects in an Exchange organization rather than what objects have been viewed.

https://technet.microsoft.com/en-us/library/dd335144(v=exchg.150).aspx
do one thing, by default exchange audit logging for all cmdlets except for get and search cmdlets, so add the Get-Messagetrackinglog into the audit logging configuration by running the below cmd:

Set-AdminAuditLogConfig -AdminAuditLogCmdlets "*, Get-Messagetrackinglog"

after 1 hour, track something by  running Get-Messagetrackinglog ******

then run

Search-AdminAuditLog -StartDate "06/01/2015 07:00" -EndDate "06/01/2015 18:00" | Sort RunDate | Format-T
able RunDate, Caller, CmdletName, CmdletParameters -AutoSize

after modifying to the appropriate time in the above cmd and see if it will show the Get-Messagetrackinglog or not.
ASKER CERTIFIED SOLUTION
Avatar of Marwan Osman
Marwan Osman
Flag of Lebanon image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Thank you for your time and for the answer
You are welcome but it was preferred to wait for another expert comment to see if we can work around the issue