Search-AdminAuditLog

The Cmdlets parameter filters the results by the cmdlets that were used. You can specify multiple cmdlets separated by commas.

In the results of this cmdlet, this property is named CmdletName.

This parameter is available only in on-premises Exchange.

The DomainController parameter specifies the domain controller that's used by this cmdlet to read data from or write data to Active Directory. You identify the domain controller by its fully qualified domain name (FQDN). For example, dc01.contoso.com.

The EndDate parameter specifies the end date of the date range.

Use the short date format that's defined in the Regional Options settings on the computer where you're running the command. For example, if the computer is configured to use the short date format MM/dd/yyyy, enter 09/01/2018 to specify September 1, 2018. You can enter the date only, or you can enter the date and time of day. If you enter the date and time of day, enclose the value in quotation marks ("), for example, "09/01/2018 5:00 PM".

In the cloud-based service, if you specify a date/time value without a time zone, the value is in Coordinated Universal Time (UTC). To specify a date/time value for this parameter, use either of the following options:

• Specify the date/time value in UTC: For example, "2021-05-06 14:30:00z".
• Specify the date/time value as a formula that converts the date/time in your local time zone to UTC: For example, (Get-Date "5/6/2021 9:30 AM").ToUniversalTime(). For more information, see Get-Date.

In the results of this cmdlet, the date/time when the change was made (the cmdlet was run) is returned in the property named RunDate.

The ExternalAccess parameter filters the results by changes that were made (cmdlets that were run) by users outside of your organization. Valid values are:

• $true: Only return audit log entries where the change was made by an external user. In Exchange Online, use value to return audit log entries for changes that were made by Microsoft datacenter administrators.
• $false: Only return audit log entries where the change was made by an internal user.

The IsSuccess parameter filters the results by whether the changes were successful. Valid values are:

• $true: Only return audit log entries where the change was successful (in other words, the cmdlet ran successfully).
• $false: Only return audit log entries where the change was not successful (in other words, the cmdlet did not run successfully and resulted in an error).

In the results of this cmdlet, this property is named Succeeded.

The ObjectIds parameter filters the results by the object that was modified (the mailbox, public folder, Send connector, transport rule, accepted domain, etc. that the cmdlet operated on). A valid value depends on how the object is represented in the audit log. For example:

• Name
• Canonical distinguished name (for example, contoso.com/Users/Akia Al-Zuhairi)
• Public folder identity (for example, \Engineering\Customer Discussion)

You'll likely need to use other filtering parameters on this cmdlet to narrow down the results and identify the types of objects that you're interested in. In the results of this cmdlet, this property is named ObjectModified.

You can enter multiple values separated by commas. If the values contain spaces or otherwise require quotation marks, use the following syntax: "Value1","Value2",..."ValueN".

The Parameters parameter filters the results by the parameters that were used. You can only use this parameter with the Cmdlets parameter (you can't use it by itself). You can specify multiple parameters separated by commas.

In the results of this cmdlet, this property is named CmdletParameters

The ResultSize parameter specifies the maximum number of results to return. The default value is 1000.

The maximum results to return is 250,000.

The StartDate parameter specifies the start date of the date range.

Use the short date format that's defined in the Regional Options settings on the computer where you're running the command. For example, if the computer is configured to use the short date format MM/dd/yyyy, enter 09/01/2018 to specify September 1, 2018. You can enter the date only, or you can enter the date and time of day. If you enter the date and time of day, enclose the value in quotation marks ("), for example, "09/01/2018 5:00 PM".

In the cloud-based service, if you specify a date/time value without a time zone, the value is in Coordinated Universal Time (UTC). To specify a date/time value for this parameter, use either of the following options:

• Specify the date/time value in UTC: For example, "2021-05-06 14:30:00z".
• Specify the date/time value as a formula that converts the date/time in your local time zone to UTC: For example, (Get-Date "5/6/2021 9:30 AM").ToUniversalTime(). For more information, see Get-Date.

In the results of this cmdlet, the date/time when the change was made (the cmdlet was run) is returned in the property named RunDate.

The StartIndex parameter specifies the position in the result set where the displayed results start.

The UserIds parameter filters the results by the user who made the change (who ran the cmdlet).

A typical value for this parameter is the user principal name (UPN; for example, [email protected]). But, updates that were made by system accounts without email addresses might use the Domain\Username syntax (for example, NT AUTHORITY\SYSTEM (MSExchangeHMHost)).

You can enter multiple values separated by commas. If the values contain spaces or otherwise require quotation marks, use the following syntax: "User1","User2",..."UserN".

In the results of this cmdlet, this property is named Caller