Share via

Admin Audit logs.

Microsoft Q & A 386 Reputation points
2022-06-24T17:06:03.067+00:00

AcceptMessagesOnlyFromSendersOrMembers setting was changed in several groups. Need to check in Admin audit logs who made this change. Please suggest how to filter this in admin audit logs via PowerShell or GUI for one GROUP. As for one day more than 250000 entries are coming for all admin activities , so can not go for full logs.

Exchange | Exchange Server | Management
Exchange | Exchange Server | Management

The administration and maintenance of Microsoft Exchange Server to ensure secure, reliable, and efficient email and collaboration services across an organization.

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Vasil Michev 127K Reputation points MVP Volunteer Moderator
    2022-06-24T18:43:43.75+00:00

    If using the Search-AdminAuditLog cmdlet, use the -Cmdlets and -Parameters parameter to narrow the search to just the specific operations: 

    Search-AdminAuditLog -Cmdlets Set-UnifiedGroup -Parameters AcceptMessagesOnlyFromSendersOrMembers

    You can also specify run the cmdlet to check against a specific group object, by using the -ObjectId parameter. Adding a time filter will of course also help.

    If using the Search-UnifiedAuditLog cmdlet, the time/date filter is mandatory and you can further scope the result via -Operations parameter to include just the cmdlet in question, and by using the -FreeText parameter to specify the attribute changed. 

    Search-UnifiedAuditLog -StartDate 14-Jan-2022 -EndDate 19-Jun-2022 -Operations Set-UnifiedGroup -FreeText AcceptMessagesOnlyFromSendersOrMembers

    Use the -ObjectId switch to narrow the results further.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.