You have an Exchange organization. All servers in the organization have Exchange Server 2010 Service Pack 1 (SP1) installed. All servers run Windows Server 2008 R2.

The organization contains Mailbox servers, Client Access servers, and Hub Transport servers only.

You need to ensure that you can review any changes made by administrators to the Exchange configuration. The solution must identity which administrator performed each change.

What should you do?

A.
Review the connectivity logs.

B.
Run the Exchange Server User Monitor (ExMon).

C.
Run the Get-MailboxFolderStatistics cmdlet.

D.
Modify the Log Settings from the properties of the Hub Transport server.

E.
Review the Application event log.

F.
Run the Set-AdminAuditLogConfig cmdlet.

G.
Run the Set-EventLogLevel cmdlet.

H.
Run the Get-User cmdlet.

I.
Modify the Server Diagnostic Logging Properties.

J.
Run the Exchange Best Practices Analyzer.
K.
Enable SMTP protocol logging.
L.
Run the Get-MailboxStatistics cmdlet.

Explanation:
To configure the cmdlet auditing list, you need to run Set-AdminAuditLogConfig -AdminAuditLogCmdlets followed by the cmdlet name to be audited.

For instance, to audit cmdlets that contain the keyword “mailbox” within the cmdlet name, run:

Set-AdminAuditLogConfig -AdminAuditLogCmdlets *mailbox*

Reference:

http://www.exchangeinbox.com/article.aspx?i=151