PowerShell Troubleshooting
A frequent request from Exchange administrators in the past was the ability to determine who performed an operation and what was changed. With the change in PowerShell's architecture using the new remoting design, this allows for this auditing to be configured. Cmdlets will now be audited no matter where they are run when they are correctly configured.
PowerShell auditing works by calling an Admin Audit Log Agent when a cmdlet runs. The agent is one of seven available default management shell extension agents. The agent is called when a cmdlet is run, and the agent evaluates the configuration against the configured rules to determine whether the cmdlet or parameters require logging. The agent is enabled by default, and ...