CmdID / PowerShell / Cmdlets / Search
Search-AdminAuditLog
Use the Search-AdminAuditLog cmdlet to search the contents of the administrator audit log. Exchange PowerShell reference
From the Exchange PowerShell reference 11 parameters Its page in the reference
Parameters
-CmdletsThe Cmdlets parameter filters the results by the cmdlets that were used.-DomainControllerThe DomainController parameter specifies the domain controller that's used by this cmdlet to read data from or write data to Active Directory.-EndDateThe EndDate parameter specifies the end date of the date range.-ExternalAccessThe ExternalAccess parameter filters the results by changes that were made (cmdlets that were run) by users outside of your organization.-IsSuccessThe IsSuccess parameter filters the results by whether the changes were successful.-ObjectIdsThe ObjectIds parameter filters the results by the object that was modified (the mailbox, public folder, Send connector, transport rule, accepted domain, etc.-ParametersThe Parameters parameter filters the results by the parameters that were used.-ResultSizeThe ResultSize parameter specifies the maximum number of results to return.-StartDateThe StartDate parameter specifies the start date of the date range.-StartIndexThe StartIndex parameter specifies the position in the result set where the displayed results start.-UserIdsThe UserIds parameter filters the results by the user who made the change (who ran the cmdlet).