By default, audit logging creates a log entry for every cmdlet that's run. If you're enabling audit logging for the first time and want this behavior, you don't have to change the cmdlet audit list. If you've previously specified cmdlets to audit and now want to audit all cmdlets, you can audit all cmdlets by specifying the asterisk (*) wildcard character with the AdminAuditLogCmdlets parameter on the Set-AdminAuditLogConfig cmdlet, as shown in the following command.

	Copy Code
Set-AdminAuditLogConfig -AdminAuditLogCmdlets *

You can specify which cmdlets to audit by providing a list of cmdlets using the AdminAuditLogCmdlets parameter. When you provide the list of cmdlets to audit, you can provide single cmdlets, cmdlets with the asterisk (*) wildcard characters, or a mix of both. Each entry in the list is separated by commas. The following values are all valid:

• New-Mailbox
  
  
• *TransportRule
  
  
• *Management*
  
  
• Set-Transport*
  
  

This example audits the cmdlets specified in the preceding list.

	Copy Code
Set-AdminAuditLogConfig -AdminAuditLogCmdlets New-Mailbox, *TransportRule, *Management*, Set-Transport*

For detailed syntax and parameter information, see Set-AdminAuditLogConfig.

By default, audit logging creates a log entry for every cmdlet that's run, regardless of the parameters specified. If you're enabling audit logging for the first time and want this behavior, you don't have to change the parameter audit list. If you've previously specified parameters to audit and now want to audit all parameters, you can do so by specifying the asterisk (*) wildcard character with the AdminAuditLogParameters parameter on the Set-AdminAuditLogConfig cmdlet, as shown in the following command.

	Copy Code
Set-AdminAuditLogConfig -AdminAuditLogParameters *

You can specify which parameters you want to audit by using the AdminAuditLogParameters parameter. When you provide the list of parameters to audit, you can provide single parameters, parameters with the asterisk (*) wildcard characters, or a mix of both. Each entry in the list is separated by commas. The following values are all valid:

• Database
  
  
• *Address*
  
  
• Custom*
  
  
• *Region
  
  

Note:
For an audit log entry to be created when a command is run, the command must include at least one or more parameters that exist on at least one or more cmdlets specified with the AdminAuditLogCmdlets parameter.

This example audits the parameters specified in the preceding list.

	Copy Code
Set-AdminAuditLogConfig -AdminAuditLogParameters Database, *Address*, Custom*, *Region

For detailed syntax and parameter information, see Set-AdminAuditLogConfig.

The audit log age limit determines how long audit log entries will be retained. When a log entry exceeds the age limit, it's deleted. The default is one year.

You can specify the number of days, hours, minutes, and seconds that audit log entries should be kept. To specify a value, use the format dd.hh.mm:ss where the following applies:

• dd   Number of days to keep the audit log entry
  
  
• hh   Number of hours to keep the audit log entry
  
  
• mm   Number of minutes to keep the audit log entry
  
  
• ss   Number of seconds to keep the audit log entry
  
  

Caution:
You can set the audit log age limit to a value that's less than the current age limit. If you do this, any audit log entry whose age exceeds the new age limit will be deleted. If you set the age limit to 0, Exchange deletes all the entries in the audit log. We recommend that you grant permissions to configure the audit log age limit only to highly trusted users.

This example specifies an age limit of two years and six months.

	Copy Code
Set-AdminAuditLogConfig -AdminAuditLogAgeLimit 913.00:00:00

For detailed syntax and parameter information, see Set-AdminAuditLogConfig.

Cmdlets that start with the verb Test aren't logged by default. This is because Test cmdlets can generate a significant amount of data in a short time. Only enable the logging of Test cmdlets for short periods of time.

This command enables the logging of Test cmdlets.

	Copy Code
Set-AdminAuditLogConfig -TestCmdletLoggingEnabled $True

This command disables the logging of Test cmdlets.

	Copy Code
Set-AdminAuditLogConfig -TestCmdletLoggingEnabled $False

For detailed syntax and parameter information, see Set-AdminAuditLogConfig.

To disable administrator audit logging, use the following command.

	Copy Code
Set-AdminAuditLogConfig -AdminAuditLogEnabled $False

To enable administrator audit logging, use the following command.

	Copy Code
Set-AdminAuditLogConfig -AdminAuditLogEnabled $True

To view the administrator audit logging settings that you've configured for your organization, use the following command.

	Copy Code
Get-AdminAuditLogConfig