If I run below command: Add-MailboxPermission -identity mailbox1 -user 'domain\user2' -AccessRights 'FullAccess' Then I run below admin audit command: Search-AdminAuditLog –cmdlets Add-MailboxPermission I can see the corresponding entry for my EMS command with me being the caller and mailbox1 as the target mailbox, but I don't see 'domain\user2' as parameter. I can only see 'domain\user2' in the XML export fo the audit log. Is there any way to reveal the all the parameters (e.g. 'domain\user2') using search-adminauditlog? On a related note, is there a way to determine the size of the hidden audit mailbox under Exchange 2010 SP1? thanks

Hi Please try the command: (Search-AdminAuditLog –cmdlets Add-MailboxPermission).CmdletParameters It will display all the parameter you input in Add-MailboxPermission. For your second question, What is hidden audit mailbox? Generally, we can use the command Get-MailboxStatistics to see the mailbox size. Get-MailboxStatistics -identity 'MailboxName' | Select-Object TotalItemSize Cheers Zi Feng

Hi Zi Feng, I tried "(Search-AdminAuditLog –cmdlets Add-MailboxPermission).CmdletParameters", but it returned nothing. For the hidden auit mailbox, how do we identify the name of the audit mailbox? Audit mailbox is created by Exchange without storage quota instead of administrator since SP1, I assume it has a randomly assigned name. One more question, is there a way to export the entire audit log to XML file to a protected LAN share? I tried New-MailboxAuditLogSearch to export the admin log for a one month period and got "The search result is too large to send as the attachment.". Turns out the attachment size of New-MailboxAuditLogSearch is limited to 10MB. I wonder if there is a more efficient way to export the log directly to disk. Thanks & Cheers! Would be nice if Microsoft allow MAPI access to the hidden audit mailbox like pre-SP1, just make it read-only.

Hi Sorry, cause I thought you got only one entry for Add-MailboxPermission You can try the command Search-AdminAuditLog –cmdlets Add-MailboxPermission | Foreach{$_.CmdletParameters;""} Exchange 2010 sp1 adminaudit log mailbox is hidden by defualt. For Administrator Audit Logging Mailbox, you can refer to the Blog Changes in Exchange 2010 SP1 Administrator Audit Logging http://www.shudnow.net/2010/08/03/changes-in-exchange-2010-sp1-administrator-audit-logging/ And 10MB limitation is by design. I think maybe we can not increase. Cheers Zi Feng

Hi Sorry, cause I thought you got only one entry for Add-MailboxPermission You can try the command Search-AdminAuditLog –cmdlets Add-MailboxPermission | Foreach{$_.CmdletParameters;""} Exchange 2010 sp1 adminaudit log mailbox is hidden by defualt. For Administrator Audit Logging Mailbox, you can refer to the Blog Changes in Exchange 2010 SP1 Administrator Audit Logging http://www.shudnow.net/2010/08/03/changes-in-exchange-2010-sp1-administrator-audit-logging/ And 10MB limitation is by design. I think maybe we can not increase. Cheers Zi Feng