Stéphane Boisvert
asked on
Who used Get-Messagetrackinglog powershell command
Hi
There a simply way to know if an administrator used the command Get-Messagetrackinglog ?
I search in the Windows Event Viewer but I didn't find anything
Thank you in advance
There a simply way to know if an administrator used the command Get-Messagetrackinglog ?
I search in the Windows Event Viewer but I didn't find anything
Thank you in advance
Actually you can audit using the exchange 2013 built-in audit reports who use cmdlets to change the exchange configuration, the cmdlets started with new-*** or set-*** or remove-****, but the cmdlets started with get-**** are not audited by these built-in reports.
ASKER
There no way to see it in the Windows Event Viewer ?
No, it is not writen in the event viewer, but I am still working on how to audit the get-***
I run :
Search-AdminAuditLog -StartDate "06/01/2015 07:00" -EndDate "06/01/2015 18:00" | Sort RunDate | Format-T
able RunDate, Caller, CmdletName, CmdletParameters -AutoSize
it shows the set-cmdlets and the remove-*** ......... but unfortunately not shown the cmdlets starting with get-
I run :
Search-AdminAuditLog -StartDate "06/01/2015 07:00" -EndDate "06/01/2015 18:00" | Sort RunDate | Format-T
able RunDate, Caller, CmdletName, CmdletParameters -AutoSize
it shows the set-cmdlets and the remove-*** ......... but unfortunately not shown the cmdlets starting with get-
as in the below technet article, Get- and Search- cmdlets aren't logged. Audit logging is intended to show what actions have been taken to modify objects in an Exchange organization rather than what objects have been viewed.
https://technet.microsoft.com/en-us/library/dd335144(v=exchg.150).aspx
https://technet.microsoft.com/en-us/library/dd335144(v=exchg.150).aspx
do one thing, by default exchange audit logging for all cmdlets except for get and search cmdlets, so add the Get-Messagetrackinglog into the audit logging configuration by running the below cmd:
Set-AdminAuditLogConfig -AdminAuditLogCmdlets "*, Get-Messagetrackinglog"
after 1 hour, track something by running Get-Messagetrackinglog ******
then run
Search-AdminAuditLog -StartDate "06/01/2015 07:00" -EndDate "06/01/2015 18:00" | Sort RunDate | Format-T
able RunDate, Caller, CmdletName, CmdletParameters -AutoSize
after modifying to the appropriate time in the above cmd and see if it will show the Get-Messagetrackinglog or not.
Set-AdminAuditLogConfig -AdminAuditLogCmdlets "*, Get-Messagetrackinglog"
after 1 hour, track something by running Get-Messagetrackinglog ******
then run
Search-AdminAuditLog -StartDate "06/01/2015 07:00" -EndDate "06/01/2015 18:00" | Sort RunDate | Format-T
able RunDate, Caller, CmdletName, CmdletParameters -AutoSize
after modifying to the appropriate time in the above cmd and see if it will show the Get-Messagetrackinglog or not.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Thank you for your time and for the answer
You are welcome but it was preferred to wait for another expert comment to see if we can work around the issue