Exchange Admin Audit Log Event ID 25739

25739: Stop-UMPhoneSession Exchange cmdlet issued

This is an event from Exchange audit event from LOGbinder EX generated by Log  Admin Audit.

On this page

• Description of this event
• Field level details
• Examples

We could not find any documentation on TechNet about this cmdlet. Please let us know if you are aware of any.

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Description Fields in 25739

Field	Description
Occurred	Date and time when Exchange registered the cmdlet.
Cmdlet	The cmdlet that was issued.
Performed by	The user who issued the cmdlet.
Succeeded	"Yes", if succeeded, "No", otherwise.
Error	"None", if the cmdlet resulted in no error, the error message otherwise.
Originating server	The host name of the server.
Object modified	The object that was modified by the cmdlet.
Parameters	The list of parameters, listing them by the parameter''s Name and Value.
Modified properties	Modified properties, if any (otherwise "n/a").
Additional information	Additional information, if any (otherwise "n/a").

Supercharger Enterprise

Load Balancing for Windows Event Collection

 

 

Upcoming Webinars Understanding REST APIs and Their Security Issues: Secrets, Input Validation, Output Filtering, Call Limits, Automation, Authorization Top 8 Features of Human Risk Management that Results in Real Behavior Change From the Trenches: How BeyondTrust Detected a Breach at Okta and Lessons we Keep Learning from This Story

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy