Powershell: You want to determine which Exchange admin ran a PowerShell command edited a specific mailbox

Scenario: You want to determine which Exchange admin edited/altered the mailbox of a specific user HarryJ.  HarryJ could no longer access OWA as someone disabled it.  Now to determine  the admin that made the change.

Solution: Run the following:

Search-AdminAuditLog -cmdlets Set-CasMailbox -startdate “2/28/201 7:00PM” -enddate “3/1/2017  9:00AM” | Where ObjectModified -like *HarryJ* | Out-gridview

Leave a comment