Exchange 2013 Command Log

#MsExchange #Powershell

One of the things I like about Exchange 2010 is the ability in the Exchange Management Console to view the command log.  So typically I would do some in the console, the get the command by clicking View and selecting View Exchange Management Shell Command Log, finding the command I just ran and using it in a script.

Well Exchange 2013 is all web based now and that feature has gone :-( but you can still get the information by using the  Search-AdminAuditLog cmdlet.

This works for both Exchange 2010 and 2013 .. enjoy

$whoai = ([System.Security.Principal.WindowsIdentity]::GetCurrent()).Name
 $saal = Search-AdminAuditLog -UserIds $whoai | Sort RunDate -Descending
 $Matrix = @()
 ForEach($Item in $saal){
 $tmpMatrix = ""|Select Caller, When, Change
 $tmpMatrix.Caller = $Item.Caller
 $tmpMatrix.When = $Item.RunDate
 $tmpMatrix.Change = $Item.CmdLetName + " "
 $tmpMatrix.Change += "'" + $item.ObjectModified + "' "
$tmpCmdletParameters = $item.CmdletParameters
 $Param = ""
 ForEach($tmpParam in $tmpCmdletParameters){
 $Param += " -" + $tmpParam.Name + " '" + $tmpParam.Value + "' "
 }
 $tmpMatrix.Change += $Param
 $Matrix += $tmpMatrix
 }
$Matrix | ft -auto -wrap