You need to be assigned permissions before you can perform this procedure. To see what permissions you need, see the "Administrator audit logging" entry in the Exchange and Shell Infrastructure Permissions topic.

Note:
You can't use the EMC to specify the cmdlets to be audited.

By default, audit logging creates a log entry for every cmdlet that's run. If you're enabling audit logging for the first time and want this behavior, you don't have to change the cmdlet audit list. If you've previously specified cmdlets to audit and now want to audit all cmdlets, you can audit all cmdlets by specifying the asterisk (*) wildcard character with the AdminAuditLogCmdlets parameter on the Set-AdminAuditLogConfig cmdlet, as shown in the following command.

	Copy Code
Set-AdminAuditLogConfig -AdminAuditLogCmdlets *

You can specify which cmdlets to audit by providing a list of cmdlets using the AdminAuditLogCmdlets parameter. When you provide the list of cmdlets to audit, you can provide single cmdlets, cmdlets with the asterisk (*) wildcard characters, or a mix of both. Each entry in the list is separated by commas. The following values are all valid:

• New-Mailbox
  
  
• *TransportRule
  
  
• *Management*
  
  
• Set-Transport*
  
  

This example audits the cmdlets specified in the preceding list.

	Copy Code
Set-AdminAuditLogConfig -AdminAuditLogCmdlets New-Mailbox, *TransportRule, *Management*, Set-Transport*

For detailed syntax and parameter information, see Set-AdminAuditLogConfig.

You need to be assigned permissions before you can perform this procedure. To see what permissions you need, see the "Administrator audit logging" entry in the Exchange and Shell Infrastructure Permissions topic.

Note:
You can't use the EMC to specify the parameters to be audited.

By default, audit logging creates a log entry for every cmdlet that's run, regardless of the parameters specified. If you're enabling audit logging for the first time and want this behavior, you don't have to change the parameter audit list. If you've previously specified parameters to audit and now want to audit all parameters, you can do so by specifying the asterisk (*) wildcard character with the AdminAuditLogParameters parameter on the Set-AdminAuditLogConfig cmdlet, as shown in the following command.

	Copy Code
Set-AdminAuditLogConfig -AdminAuditLogParameters *

You can specify which parameters you want to audit by using the AdminAuditLogParameters parameter. When you provide the list of parameters to audit, you can provide single parameters, parameters with the asterisk (*) wildcard characters, or a mix of both. Each entry in the list is separated by commas. The following values are all valid:

• Database
  
  
• *Address*
  
  
• Custom*
  
  
• *Region
  
  

Note:
For an audit log entry to be created when a command is run, the command must include at least one or more parameters that exist on at least one or more cmdlets specified with the AdminAuditLogCmdlets parameter.

This example audits the parameters specified in the preceding list.

	Copy Code
Set-AdminAuditLogConfig -AdminAuditLogParameters Database, *Address*, Custom*, *Region

For detailed syntax and parameter information, see Set-AdminAuditLogConfig.

You need to be assigned permissions before you can perform this procedure. To see what permissions you need, see the "Administrator audit logging" entry in the Exchange and Shell Infrastructure Permissions topic.

Note:
You can't use the EMC to specify the audit log age limit.

The audit log age limit determines how long audit log entries will be retained. When a log entry exceeds the age limit, it's deleted. The default is one year.

You can specify the number of days, hours, minutes, and seconds that audit log entries should be kept. To specify a value, use the format dd.hh.mm:ss where the following applies:

• dd   Number of days to keep the audit log entry
  
  
• hh   Number of hours to keep the audit log entry
  
  
• mm   Number of minutes to keep the audit log entry
  
  
• ss   Number of seconds to keep the audit log entry
  
  

Caution:
You can set the audit log age limit to a value that's less than the current age limit. If you do this, any audit log entry whose age exceeds the new age limit will be deleted. If you set the age limit to 0, Exchange deletes all the entries in the audit log. We recommend that you grant permissions to configure the audit log age limit only to highly trusted users.

This example specifies an age limit of two years and six months.

	Copy Code
Set-AdminAuditLogConfig -AdminAuditLogAgeLimit 913.00:00:00

For detailed syntax and parameter information, see Set-AdminAuditLogConfig.

You need to be assigned permissions before you can perform this procedure. To see what permissions you need, see the "Administrator audit logging" entry in the Exchange and Shell Infrastructure Permissions topic.

Note:
You can't use the EMC to enable or disable logging of Test cmdlets.

Cmdlets that start with the verb Test aren't logged by default. This is because Test cmdlets can generate a significant amount of data in a short time. Only enable the logging of Test cmdlets for short periods of time.

This command enables the logging of Test cmdlets.

	Copy Code
Set-AdminAuditLogConfig -TestCmdletLoggingEnabled $True

This command disables the logging of Test cmdlets.

	Copy Code
Set-AdminAuditLogConfig -TestCmdletLoggingEnabled $False

For detailed syntax and parameter information, see Set-AdminAuditLogConfig.

After you configure administrator audit logging, you may also want to:

• Search the Administrator Audit Log
  
  
• View Administrator Audit Logging Settings
  
  
• Disable Administrator Audit Logging
  
  
• Configure Administrator Audit Logging