Hi,

We have Exchange Server 2010 installed in our Organization

We are in a situation where as Distribution Groups Message Delivery Restriction senders (Some of the Users) removed Automatically.

How to monitor and prevent this kind of situation.

Hi ,

Enable Exchange Admin Audit logging so that we can able to track the changes in exchange environment.

Thanks Nithya,

I per my understanding Audit logging is enabled by default.

How to monitor changes on Distribution Group or How to extract the data on Changes to Distribution Group.

Thanks.

Hi ,

Please have a look in to the below mentioned script which would help you to extract all the Admin changes to a HTML format report.

Reference Link :

http://mikepfeiffer.net/2010/08/administrator-audit-log-reports-in-html-format-exchange-2010-sp1/

Below is the command which will show you the changes happened on the distribution group.

Search-AdminAuditLog -Cmdlets Set-DistributionGroup -UserIds abc\nithya -ResultSize unlimited

try to run the following command

Search-AdministratorAuditLog -StartDate "05/26/2015 07:00" -EndDate "05/28/2015 16:00" -IsSuccess $true -Cmdlets Set-DistributionGroup -UserIds "Domain\GName" -ResultSize 250000

Search-AdministratorAuditLog -StartDate $yesterday  -IsSuccess $true -ResultSize 250000
$yesterday = (Get-Date).AddDays(-1).ToString('MM-dd-yyyy')

$yesterday = (Get-Date).AddDays(-1).ToString('MM-dd-yyyy')

Search-AdministratorAuditLog -StartDate $yesterday  -IsSuccess $true -ResultSize 250000

$yesterday = (Get-Date).AddDays(-1).ToString('MM-dd-yyyy')

Search-AdministratorAuditLog -StartDate $yesterday  -IsSuccess $true -ResultSize 250000

$yesterday = (Get-Date).AddDays(-1).ToString('MM-dd-yyyy')

Search-AdministratorAuditLog -StartDate $yesterday  -IsSuccess $true -ResultSize 250000

$yesterday = (Get-Date).AddDays(-1).ToString('MM-dd-yyyy')

Search-AdministratorAuditLog -StartDate $yesterday  -IsSuccess $true -ResultSize 250000

$yesterday = (Get-Date).AddDays(-1).ToString('MM-dd-yyyy')

Search-AdministratorAuditLog -StartDate $yesterday  -IsSuccess $true -ResultSize 250000

$yesterday = (Get-Date).AddDays(-1).ToString('MM-dd-yyyy')

Search-AdministratorAuditLog -StartDate $yesterday  -IsSuccess $true -ResultSize 250000

Thanks for the reply

We are not getting the results for changes done.

Any how thankd for the commands.