Audit logs

Question

Hi All

I am using exchange 2010 hybrid environment. i have most of DLs in exchange online with few DLs in onprem. i have one DL in onprem lets say dl1@Company portal .com. The membership to this DL has been modified(users were added/removed). i want to know who has modified this membership. how do i check the audit logs for this in exchange 2010.I also would like to know the procedure to check this in exchange 2016. experts guide me

Answer 1

Hi @Glenn Maxwell ,
Please run the command provide by Andy to view the output.
You can also run the following command to verify whether the admin audit log can record the operation, and please noted that the admin audit log default setting is to keep for 90 days.

Get-AdminAuditLogConfig  

Please refer to: Mailbox audit logging in Exchange Server

----------

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Works the same for 2010 and 2016:

Search-AdminAuditLog -Cmdlets Add-DistributionGroupMember, Remove-DistributionGroupMember -ObjectIds 'dl1'  

https://learn.microsoft.com/en-us/powershell/module/exchange/search-adminauditlog?view=exchange-ps

Answer 3

i have used the below syntax i am not getting any ouput
Search-AdminAuditLog -Cmdlets Remove-DistributionGroupMember -ObjectIds 'd1@Company portal .com'

I am using exchange hybrid environment will i get any logs from exchange online