Use Admin Audit Logging to Track Changes Made by Administrators

Comments

1. 

   Josue 21 Apr 2021 Reply

   Same here, It does happen on Exchange Online though.

   1. 

      Tony Redmond 22 Apr 2021 Reply

      This is a very old article (2015). Today, we would use the Office 365 audit log (aka the unified log) to search for information, including Exchange Online admin actions. For example, here’s how to find all Set-Mailbox actions performed today. The identities returned in these records are a lot easier to deal with.

      Search-UnifiedAuditLog -Operations Set-Mailbox -StartDate 22-Apr-2021 -EndDate 23-apr-2021 -Formatted -ResultSize 1000 | ft creationdate, userids, operations

      1. 

         Tony Redmond 22 Apr 2021 Reply

         More here: https://office365itpros.com/2020/10/08/search-office-365-audit-log-object-specific-events/

2. 

   Taner 9 Dec 2020 Reply

   Hi;
   On your first example, how can you find the user is Alex by using identity field:
   Identity : AAMkADI1NGQyZjhiLTFkYTAtNDhmYy05OTBiLTU4MGZlODY0MDQ3NgBGAAAAAAAkqZy/nl4jSa4VBIka73bMBwCEoBRTwPA6QK
   t9HgzDn/p6AAAAAAEYAACEoBRTwPA6QKt9HgzDn/p6AACUBtrhAAA=

   1. 

      faruk 13 Jan 2022 Reply

      Could yo get an answer or fidn a solution for this?
      farukdemirel@gmail.com

3. 

   Francesco 26 Sep 2020 Reply

   Hi Paul
   i’ve got an Exchange 2016 CU18. I use search-adminauditlog to track what admin do. But result is partial or incomplete.
   What can i check to have the right report?
   i try to set-new or create and modify new send connector, but nothing trace in report admin search.
   Tx for your help.

4. 

   Allan Jimmy 5 Sep 2020 Reply

   Hello Paul,

   Is there a way to find which sender we blocked in our HostedContentFilterPolicy in Exchange Online Protection

   Search-adminauditlog -cmdlets set-hostedcontentfilterpolicy -startdate -enddate | select objectmodified, caller, rundate

   Using the above command (even with FL), I cannot get to find which sending address was blocked. It shows us the policy that was modified but not the value

5. 

   Shawn 29 Apr 2019 Reply

   I like this article very much. What about exporting this so it can be saved / emailed to auditor?

6. 

   Reza Ghazian 25 Sep 2018 Reply

   Dear Paul

   I’m trying to create an automatic welcome message for new users . I ‘v done all the setting the same as in my experimental and operational environment . but it works well in my experimental enviroment that is exchange 2016 but i get an error in exchange 2013 which the event ID is 5000

   Log content:
   Cmdlet Name: Enable-Mailbox
   Object Modified: mapnagenerator.com/Domain Users/zzzz/Test
   Parameter: Identity = Test
   Parameter: Database = Mailbox Database 1613186978
   Caller: mapnagenerator.com/Domain Users/ICT Unit/Ghazian, Reza
   ExternalAccess: False
   Succeeded: True
   Run Date: 2018-09-24T12:15:12
   OriginatingServer: XERXES-2 (15.00.1210.002)

   Error:
   Microsoft.Exchange.Data.ApplicationLogic.AuditLogException: An error occurred while trying to access the audit log. For more details, see the inner exception. —> System.Net.WebException: The request failed with an empty response.
   at System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse(SoapClientMessage message, WebResponse response, Stream responseStream, Boolean asyncCall)
   at System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters)
   …

7. 

   Honey19 21 Aug 2018 Reply

   Is it possible to check when a specific mailbox audit logging was enabled?

8. 

   Dmitry Alferov 13 Feb 2018 Reply

   Hello, Paul!
   Sometimes field “Caller” contains only value “********” (8 asterics).
   Who is it? How to identify that user?

   1. 

      Paul Cunningham 14 Feb 2018 Reply

      Which version of Exchange?

      1. 

         Rudolf 30 Mar 2019 Reply

         Hi Paul,
         is there an answer? I can see the same in Exchange 2013 CU19

      2. 

         Josue 21 Apr 2021 Reply

         Same here, It does happen on Exchange Online though.

9. 

   Shelly 18 Oct 2017 Reply

   Hello Paul, i have a customer, he only wants to export the admin audit report from the GUI. However, he received below errors: “we apologize for the inconvenience. An unexpected error occurred while your search request was being processed”. We tried to perform new-mailboxreportrequest for that systemmailbox, issue persists. Could you give us some guideline for this? thank you.

10. 

    Dave Medlicott 12 Oct 2017 Reply

    Hi Paul,

    I am a CSP and so have a large number of tenants to turn Audit logging on for. Is it possible to turn Audit logging on via PowerShell?

    Thanks
    Dave

    1. 

       Paul Cunningham 12 Oct 2017 Reply

       It’s already enabled by default. If you want to adjust the config you can do it with the Set-AdminAuditLogConfig cmdlet.

11. 

    Roberto Oliveira 16 Sep 2017 Reply

    Thank you a lot for all your Exchange articles, Paul!
    On searching the audit log, if one suspects a rogue admin may be granting access to user mailboxes, is there a way to read who the rights are being granted to?
    In your case, above, you say someone “granted the user Alex Heyne access to the CEO Alannah Shaw’s mailbox”. If Alex Heyne logged in as user “administrator”, did that, read what he needed, then again as “administrator” removed that access, the ‘caller’, as in your example, would be administrator. How would we find out who administrator granted access to?
    Thanks!

    1. 

       Paul Cunningham 16 Sep 2017 Reply

       It’s stored in the ModifiedProperties, but not visible in the default PS output.

       (Search-AdminAuditLog -Cmdlets Add-MailboxPermission).ModifiedProperties

       ^^^ should show it. Play around with that until you get the full results you’re interested in.

    2. 

       Kevin 12 Jun 2018 Reply

       Roberto,
       I couldn’t get Paul’s reply below to work, so after a good amount of searching I found the answer at: https://blogs.technet.microsoft.com/exchange/2015/06/15/parsing-the-admin-audit-logs-with-powershell/

       Set your search to a variable then $Search.CmdletParameters

12. 

    Ed Kummel 5 May 2017 Reply

    Thank you Paul for all your contributions. I use your stuff on a daily basis. We recently got the edict to implement auditing for admins and mailboxes. I’ve done all the necessary tasks and can download audit logs all day long….from the EMS.
    But, if I open a generic Powershell session (Powershell version 4.0), add the Exchange Powershell snapins and then run the Search-AdminAuditLog from there, we get a weird error that says:
    search-adminauditlog : The attempt to search the administrator audit log failed. Please try again later.
    Checking the Event Logs, I find the error in the MSExchange Management Event log.
    Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogSearchException: The attempt to search the administrator audit log failed. Please try again later. —> Microsoft.Exchange.Data.ApplicationLogic.AuditLogAccessDeniedException: The requesting account doesn’t have permission to access the audit log. —> System.Web.Services.Protocols.SoapException: The requesting account does not have permission to serialize tokens.

    Every other Exchange command runs in this Powershell session *EXCEPT* those commands relating to Audit logs.
    I am also starting the Powershell session with a runas administrator. And if I do a “whoami”, it returns my organizational Administrator account.

    I’ve scoured the web for details on this, but the results are always talking about the EMS, not a generic Powershell session.

    Any ideas?

    1. 

       Paul Cunningham 5 May 2017 Reply

       It’s not supported or recommended to load the Exchange snapins into a regular PS console like that, except for specific scenarios under the guidance of MS Support. One of the reasons being that it bypasses RBAC. I suspect what you’re seeing is a symptom of that.

13. 

    theresa 16 Mar 2017 Reply

    Noticed when Partners are set up to manage a tenant, new accounts, changes and disabled accounts do not show up in the audit log of the targeted tenant. By design, or bug?

14. 

    thoufeeq 1 Mar 2017 Reply

    Hi,
    In Exchange 2016, the Search-AdminAuditLog returns UPN as caller which was Canonical Name in the previous versions of Exchange. Is there any way to get Canonical Name as Caller ?

15. 

    jerry 30 Aug 2016 Reply

    How does one figure out which mailbox is assigned as the destination for the storage of the audit logs ?

    1. 

       Paul Cunningham 30 Aug 2016 Reply

       Audit logs are stored centrally, they’re stored in each mailbox.

       1. 

          Yehuda Matan 19 Jul 2018 Reply

          Hey Paul, what do you mean “logs are stored in each mailbox”?
          is there a way to import these logs into a 3rd party app for monitoring and alerting purposes?

          10x

16. 

    Eric 4 Aug 2016 Reply

    Hi,
    Can someone please help me figure out how to get a more useful username out of the .CmdletParameters value. Currently when you run this command…

    (Search-AdminAuditLog –cmdlets Add-MailboxPermission).CmdletParameters

    It returns the following,

    Identity Lab Test 01
    AccessRights FullAccess
    InheritanceType All
    User NAMPR06A002Eric 577832002717381

    The “User” is who I granted full access to. How am I supposed to make sense of that data? Anyone know how to get it to return samaccountname or something?

    -Eric

17. Pingback: Exchange Best Practices: Admin Access to User Mailboxes

18. 

    Jason Meyer 20 May 2016 Reply

    Excellent article as always. I’m trying to determine why some admin events are not showing up in my Admin Log. Like simple mail enables, I’m finding that about 95% of them ARE showing up, and about 5% are not. So far haven’t found any differences in how the 5% are enabled.

19. 

    Scott Thompson 19 Oct 2015 Reply

    Hello again Paul…I have been asked a couple of questions by one of our auditors and I am struggling to find any solid answers. I hope that you might be able to assist.

    1. Can anyone with access to the eDiscovery portal (via the RBAC) see ALL the previously created and stored searches regardless of who created them?

    2. What audit trails are available in eDiscovery. Can I retrieve reports about who created, modified, and deleted searches along with details such as search criteria and what was done with the results (run, previewed, exported, etc)?

    Thanks

    Scott

20. 

    Terrance Brennan 25 Sep 2015 Reply

    Unfortunately, not everything done by an Admin is logged. If you open a Windows PowerShell window and load the Exchange module nothing is recorded in the audit logs. Only actions performed in the EMS are recorded.

    1. 

       Paul Cunningham 25 Sep 2015 Reply

       I can also just go into ADUC or ADSIEdit and make changes, and those won’t be logged by this feature.

       All part of a larger picture of auditing.

21. 

    Dinesh 24 Sep 2015 Reply

    Hi, I set the AdminAuditLog for 120 days with below command

    Set-AdminAuditLogConfig -AdminAuditLogAgeLimit 120.00:00:00

    when i search the logs with help of below cmdlet, it was not showing more that 1 week logs.

    Search-AdminAuditLog -StartDate 07/05/2015 -EndDate 09/20/2015

    Could you help me on this.

    Thank you.

    1. 

       Paul Cunningham 24 Sep 2015 Reply

       What was it set to before you changed it to 120 days?