Share via

Audit logs

Glenn Maxwell 13,141 Reputation points
2021-03-25T11:03:56.28+00:00

Hi All

I am using exchange 2010 hybrid environment. i have most of DLs in exchange online with few DLs in onprem. i have one DL in onprem lets say dl1@Company portal .com. The membership to this DL has been modified(users were added/removed). i want to know who has modified this membership. how do i check the audit logs for this in exchange 2010.I also would like to know the procedure to check this in exchange 2016. experts guide me

Exchange Online
Exchange Online
A cloud-based service included in Microsoft 365, delivering scalable messaging and collaboration features with simplified management and automatic updates.
Exchange | Exchange Server | Management
Exchange | Exchange Server | Management
The administration and maintenance of Microsoft Exchange Server to ensure secure, reliable, and efficient email and collaboration services across an organization.
0 comments
Answer accepted by question author
  1. Lucas Liu-MSFT 6,191 Reputation points
    2021-03-26T04:26:08.81+00:00

    Hi @Glenn Maxwell ,
    Please run the command provide by Andy to view the output.
    You can also run the following command to verify whether the admin audit log can record the operation, and please noted that the admin audit log default setting is to keep for 90 days. 

    Get-AdminAuditLogConfig

    Please refer to: Mailbox audit logging in Exchange Server

    ----------

    If the response is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

2 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Andy David - MVP 159.7K Reputation points MVP Volunteer Moderator
    2021-03-25T11:16:37.9+00:00

    Works the same for 2010 and 2016: 

    Search-AdminAuditLog -Cmdlets Add-DistributionGroupMember, Remove-DistributionGroupMember -ObjectIds 'dl1'

    https://learn.microsoft.com/en-us/powershell/module/exchange/search-adminauditlog?view=exchange-ps

    0 comments
  2. Glenn Maxwell 13,141 Reputation points
    2021-03-25T11:37:11.357+00:00

    i have used the below syntax i am not getting any ouput
    Search-AdminAuditLog -Cmdlets Remove-DistributionGroupMember -ObjectIds 'd1@Company portal .com'

    I am using exchange hybrid environment will i get any logs from exchange online

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.