Distribution list disabled in Exchange 2010 - what eventlogs can I check?

[RabbieBurns]

a distribution list has gone AWOL on my Exchange server and I want to be able to tell who disabled it, I have a log of who has been logging in to the server but what event logs will show when this distribution list was disabled (it wasnt removed as the group was still in AD)

 

Or would I have needed to have some extra verbose logging enabled to be able to tell?

[SYNACK]

I don't think stuff like this is logged by default, you'd probably need auditing on the group item for it to show up.

[sukh]

On the top of my head, I believe Powershell and EMC cmdlets are recorded, check the admin audit log.