You have an Exchange organization. All servers in the organization have Exchange Server 2010 SP1 installed. All Servers run Windows Server 2008 R2.
The organization contains Mailbox servers, Client Access servers, and Hub Transport servers only.
You need to ensure that you can review any changes made by administrators to the Exchange configuration. The solution must identify which administrators performed each change.
What Should you do?
A.
Run the Get-MailboxStatistics cmdlet.
B.
Enable SMTP protocol logging.
C.
Run the Exchange Server User Monitor (ExMon).
D.
Modify the Log Settings from the properties of the Hub Transport server.
E.
Run the Set-AdminAuditLogConfig cmdlet.
F.
Review the Application event log.
G.
Run the Get-MailboxFolderStatistics cmdlet.
H.
Modify the Server Diagnostic Logging Properties.
I.
Run the Set-EventLogLevel cmdlet.
J.
Run the Get-User cmdlet.
K.
Review the connectivity logs.
L.
Run the Exchange Best Practices Analyzer.
Explanation:
To configure the cmdlet auditing list, you need to run Set-AdminAuditLogConfig -AdminAuditLogCmdlets followed by the cmdlet name to be audited.For instance, to audit cmdlets that contain the keyword “mailbox” within the cmdlet name, run:
Set-AdminAuditLogConfig -AdminAuditLogCmdlets *mailbox*
Reference:
http://technet.microsoft.com/en-us/library/dd335109.aspx
http://technet.microsoft.com/en-us/library/dd298169.aspx
http://www.exchangeinbox.com/article.aspx?i=151