AdUser attribute change

Question

Is it possible to view what attribute changed for an ADUser like for instance if there was an additional proxyaddress that was added and when it was added.

I'm aware of the following:

Get-AdreplicationAttributemetadat -object (Get-aduser user1) -server dc1.domain.com | where-object {$_.AttributeName -eq "ProxyAddresses"} | select-object -property AttributeName,AttributeValue,FirstOriginatingCreateTime,LastOriginatingtime,LastOriginatingChangeDirectoryServerIdentity.

The problem with that is that it doesn't really give the correct information that I'm are trying to get. I mean if I go into my Exchange Server and remove and an email address policy for a specific user and then go run my above mentioned script it will give me the date and time of the policy that was removed from the the user because email address policies update AD User's Proxyaddresses attribute without saying what was added/removed.

Answer 1

@Safs-3080

If you remove an email address policy(@domain123.com) from a mailbox, the related proxy email address(@domain123.com) still exist on this mailbox, this email address will not be removed.

From Exchange side, after enabling admin audit log, you can use it to check if admin add/delete proxy email address for a mailbox:

You can also check whether admin create/delete a new email address policy:

You can click on this one to check email address policy applied on which mailbox:

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.