Robuta

https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=25538 Exchange Admin Audit Log Event ID 25538 - Dump-ProvisioningCache Exchange cmdlet issued admin audit log event id exchange