Powershell: You want to determine which Exchange admin ran a PowerShell command edited a specific mailbox

Scenario: You want to determine which Exchange admin edited/altered the mailbox of a specific user HarryJ.  HarryJ could no longer access OWA as someone disabled it.  Now to determine  the admin that made the change.

Solution: Run the following:

Search-AdminAuditLog -cmdlets Set-CasMailbox -startdate “2/28/201 7:00PM” -enddate “3/1/2017  9:00AM” | Where ObjectModified -like *HarryJ* | Out-gridview

Advertisement

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: