Share via

Audit Logs

Glenn Maxwell 13,761 Reputation points
2022-04-03T02:29:47.423+00:00

Hi All

One of my Distribution list lets say dl01@Company portal .com is deleted. I want to check from Audit Logs when was this distribution list deleted and who deleted it. we use exchange 2016 hybrid environment, i am not sure if the distribution list was in onprem or in online.
i have used the below syntax in online and i dont see any log is the below syntax correct. experts guid me and also how to check in exchange onprem.

Search-AdminAuditLog -Cmdlets Remove-DistributionGroup -ObjectIds name | Export-Csv -Path c:\temp\auditlogs.csv -NoTypeInformation

Exchange Online
Exchange Online

A cloud-based service included in Microsoft 365, delivering scalable messaging and collaboration features with simplified management and automatic updates.

Exchange | Exchange Server | Management
Exchange | Exchange Server | Management

The administration and maintenance of Microsoft Exchange Server to ensure secure, reliable, and efficient email and collaboration services across an organization.

Exchange | Hybrid management
Exchange | Hybrid management

The administration of a hybrid deployment that connects on-premises Exchange Server with Exchange Online, enabling seamless integration and centralized control.

Answer accepted by question author

Joyce Shen - MSFT 16,706 Reputation points
2022-04-04T03:06:12.253+00:00

Hi @Glenn Maxwell

You could run this command in on-prem server as well:
Search-AdminAuditLog cmdlet 

Search-AdminAuditLog -Cmdlets Remove-DistributionGroup

If your distribution groups are created in Office 365 through directory synchronization, that must be managed in the on-premises environment.

And the possible ways to remove the groups in Exchange hybrid are list here: How to delete O365 distribution group in a hybrid environment, if the operation is not performed in Exchange side, I'm afraid they will not be recorded in Exchange admin audit log.

If an Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Was this answer helpful?

0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.