Exchange Cmdlet History in Exchange 2010/2013

Having a list of all Exchange cmdlets we ran is always useful. Besides the usual methods of getting these from the PowerShell window history (by pressing the F7 key) or from the administrator audit logs, for example, the Event Log also has a list of these cmdlets!

Both in Exchange 2010 and 2013, most cmdlets are recorded under the Applications and Services Logs -> Microsoft -> MsExchange Management event log.

In here we have entries under the MSExchange CmdletLogs source and with an EventID of 1 (cmdlet ran successfully) and/or 6 (cmdlets that failed).

For example, by running the following cmdlet: Add-MailboxPermission Mota –User Nuno –AccessRights FullAccess –InheritanceType All

We get this entry in the event log: Cmdlet Add-MailboxPermission, parameters {Identity=Mota, User=Nuno, AccessRights={FullAccess}, InheritanceType=All}.

NOTE: cmdlets started with Get-* do not get logged.