Scenario: You want to determine which Exchange admin edited/altered the mailbox of a specific user HarryJ. HarryJ could no longer access OWA as someone disabled it. Now to determine the admin that made the change.
Solution: Run the following:
Search-AdminAuditLog -cmdlets Set-CasMailbox -startdate “2/28/201 7:00PM” -enddate “3/1/2017 9:00AM” | Where ObjectModified -like *HarryJ* | Out-gridview