ActiveSync Audit: Who sent the Remote Wipe command to a device?

I need to perform and audit of how many Remote wipe commands have been sent, who sent them, and to which user's devices?

Can someone let me know if this is possible? I get lots of Google hits for Transaction logging for Exchange 2003 but none for Exchange 2010....

Thanks, Chris

Solution 1:

Run this in Exchange Shell

Search-AdminAuditLog -Cmdlets "Clear-ActiveSyncDevice"

Search-AdminAuditLog : http://technet.microsoft.com/en-us/library/dd335052.aspx

Clear-ActiveSyncDevices : http://technet.microsoft.com/en-us/library/aa998614.aspx