Administrator Audit

This page allows you to search for change events initiated by administrators in your environment. Whenever an admin makes a change to a user, mailbox, database, or other resource on your Exchange servers, Exchange logs this information and the Splunk App for Microsoft Exchange displays it here.

Exchange does not log read events and the Splunk App for Microsoft Exchange does not display them.

This dashboard is only valid on Exchange Server 2010 environments.

How to use this page

• To begin auditing, enter as much detail as possible into the "Host" "Administrator," "Command," and/or "Parameters" fields above. To specify all of a certain category, use '*' (asterisk).

• Next, select an appropriate time period using the time range picker, then click "Search." The Splunk App for Microsoft Exchange displays the matching results below.

• Then, to find out additional information about the activity, click on it in the list. The Splunk App for Microsoft Exchange takes you to the base search that returned the audit.