Security – ActiveSync Audit: Who sent the Remote Wipe command to a device

activesyncexchange-2010Security

I need to perform and audit of how many Remote wipe commands have been sent, who sent them, and to which user's devices?

Can someone let me know if this is possible? I get lots of Google hits for Transaction logging for Exchange 2003 but none for Exchange 2010….

Thanks,
Chris

Best Answer

Run this in Exchange Shell

Search-AdminAuditLog -Cmdlets "Clear-ActiveSyncDevice"

Search-AdminAuditLog : http://technet.microsoft.com/en-us/library/dd335052.aspx

Clear-ActiveSyncDevices : http://technet.microsoft.com/en-us/library/aa998614.aspx

Related Topic