Is there a unique event for the Exchange Cmdlet Update-RollGroupMember
Is there a separate unique Exchange facility event for the Exchange Cmdlet "Update-RollGroupMember"?
Currently most Exchange Cmdlet events are grouped together under one event class, "Exchange Cmdlet Executed". This can make alerting on specific changes done via Exchange interfaces difficult or simply not possible.
Enhancement request 6921 has been submitted for consideration in a future release of Change Auditor.
It is possible to spot Exchange group modifications using the Active Directory side event on the Domain Controllers.
There are events "Member Added to An Exchange Administrators Groups" + "Member Removed to An Exchange Administrators Groups". These events will be produced on the domain controllers.
Limitation exists however. If the modification is performed via Exchange Console, the change is applied to Active Directory by a separate process in Exchange executed under LOCAL SYSTEM context so the change is applied (WHO field) under the Exchange$ account (where Exchange$ is the computer account where the change was applied).