Answered Distribution List modify log?

  • Monday, March 11, 2013 5:12 PM
     
     

    Hello,

    We have a Exchange 2010 environment and I want to know how if there is a way to check all modification to a Distribuitoin List from the begining.

    Creation/add/remove members etc... also the user who did the modifications?

    Thank you in advance!

All Replies

  • Tuesday, March 12, 2013 6:23 AM
    Moderator
     
     Answered Has Code

    Hi

    Do you have the backup for the members in the distribution group when it is created?

    Also, if the administrator using command to do the modification, you can use below command to check add and remove, dont forget grant permission when you run “Search-AdminAuditLog”

    Search-AdminAuditLog -Cmdlets add-distributiongroupmember, remove-distributiongroupmember

    http://technet.microsoft.com/en-us/library/ff459250(v=exchg.150).aspx

    Cheers


    Zi Feng
    TechNet Community Support

    • Marked As Answer by Albangel Tuesday, March 12, 2013 9:07 AM
    •  
  • Tuesday, March 12, 2013 9:17 AM
     
     

    Hello Zi Feng!

    Thank you very much for your reply! It was very helpful however when I run this I don't get the identity added or removed...

    Also I see something like this in some of the logs, what is this, why the system makes changes?

    RunspaceId         : 8394af81-e959-4829-b87e-18c0ba2b8daa
    ObjectModified     : domain.com/Microsoft Exchange Security Groups/Group
    CmdletName         : Add-DistributionGroupMember
    CmdletParameters   : {Identity, Member}
    ModifiedProperties : {Members}
    Caller             : NT AUTHORITY\SYSTEM (w3wp)
    Succeeded          : True
    Error              : None
    RunDate            : 12/17/2012 3:47:50 PM
    OriginatingServer  : XXXX2 (1545681)
    Identity           : RgAAAAAKtwQbqtM9SbeqqNyW8bN8BwB05ntHjyhJRp17xmKNPUBcAAAAiEkFAAB05ntHjyhJRp17xmKNPUBcAAArCJZoAAAJ
    IsValid            : True

    Best Regards,

    Albangel