Can we add a filter in Search-AdminAuditLog command to get the data from a specific originatingServer only?

Question

Hi Team,
I have multiple exchange servers and while running the Search-AdminAuditLog command it took a lot of time because pulling the data from all the servers. I want to know if is there any way to filter the data based on the originating server so not all the server data is pulled by the Search-AdminAuditLog command.
Thanks in advance!!

Answer 1

Hi,

Welcome to the Microsoft Q&A platform!

You can try to do the following:

First, perform the search to retrieve the logs. You may want to limit the search by date range to reduce the data volume.

   $startDate = (Get-Date).AddDays(-30)

   $endDate = Get-Date

   $logs = Search-AdminAuditLog -StartDate $startDate -EndDate $endDate

Once you have the logs, you can filter them based on the OriginatingServer property.

   $originatingServer = "YourServerName"

   $filteredLogs = $logs | Where-Object { $_.OriginatingServer -eq $originatingServer }

Finally, you can review the filtered logs or export them for further analysis.

   $filteredLogs | Format-Table -AutoSize

   # OR

   $filteredLogs | Export-Csv -Path "FilteredAuditLogs.csv" -NoTypeInformation

Please feel free to contact me for any updates. And if this helps, don't forget to mark it as an answer.

Answer 2

The Search-AdminAuditLog command in Exchange PowerShell does not have a direct parameter to filter results by the originating server. However, you can use the Search-UnifiedAuditLog command as an alternative. This command allows you to set the RecordType parameter to ExchangeAdmin to get similar results as Search-AdminAuditLog

Here's an example of how you can use the Search-UnifiedAuditLog command to filter by the originating server:

Search-UnifiedAuditLog -RecordType ExchangeAdmin -StartDate (Get-Date).AddMinutes(-5) -EndDate (Get-Date) | Where-Object {$_.OriginatingServer -eq "YourServerName"} 

Tips: use your real server's name instead "YourServerName".

This command will search for all Exchange admin actions in the last 5 minutes and filter the results to include only those from the specified originating server