Exchange Admin Audit Log Event ID 25100

25100: Undocumented Exchange admin operation

This is an event from Exchange audit event from LOGbinder EX generated by Log  Admin Audit.

On this page

• Description of this event
• Field level details
• Examples
• Mini-seminars on this event

This event is generated systematically by LOGbinder whenever it applies the default audit policy to the mailboxes being audited.

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Description Fields in 25100

Field	Descrption
Occurred	Date and time when Exchange registered the cmdlet.
Cmdlet	The cmdlet that was issued.
Performed by	The user who issued the cmdlet.
Succeeded	"Yes", if succeeded, "No", otherwise.
Error	"None", if the cmdlet resulted in no error, the error message otherwise.
Originating server	The host name of the server.
Object modified	The object that was modified by the cmdlet.
Parameters	The list of parameters, listing them by the parameter's Name and Value.
Modified properties	Modified properties, if any (otherwise "n/a").
Additional information	Any additional information.

Supercharger Free Edition

Your entire Windows Event Collection environment on a single pane of glass.

Free.

 

 

Upcoming Webinars Assessing the Security of Your Active Directory: User Accounts Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy