You have an Exchange organization. All servers in the organization have Exchange Server
2010 Service Pack 1 (SP1) installed. All servers run Windows Server 2008 R2.
The organization contains Mailbox servers, Client Access servers, and Hub Transport
servers only.
You need to ensure that you can review any changes made by administrators to the
Exchange configuration. The solution must identify which administrator performed each
change.
What should you do?
A.
Modify the Log Settings from the properties of the Hub Transport server.
B.
Run the Get-User cmdlet.
C.
Enable SMTP protocol logging.
D.
Run the Get-MailboxFolderStatistics cmdlet.
E.
Run the Set-EventLogLevel cmdlet.
F.
Run the Get-MailboxStatistics cmdlet.
G.
Run the Exchange Best Practices Analyzer.
H.
Run the Set-AdminAuditLogConfig cmdlet.
I.
Review the Application event log.
J.
Review the connectivity logs.
K.
Modify the Server Diagnostic Logging Properties.
L.
Run the Exchange Server User Monitor (ExMon).
Explanation:
To configure the cmdlet auditing list, you need to run Set-AdminAuditLogConfig –
AdminAuditLogCmdlets followed by the cmdlet name to be audited.
For instance, to audit cmdlets that contain the keyword “mailbox” within the cmdlet name,
run:http://technet.microsoft.com/en-us/library/dd335109.aspx
http://technet.microsoft.com/en-us/library/dd298169.aspx
http://www.exchangeinbox.com/article.aspx?i=151