I’ve found a bug in Exchange 2010 where resetting Diagnostics Logging back to defaults basically doesn’t work. There’s a screenshot of the error at the end of this post.
<--fail-->
Anyway, moving on from that, I did some searching on Technet and it states that ‘Lowest’ is the default level for all those services. WRONG (double fail). It’s the default level except for the following which are set to ‘Low’:
MSExchange RBAC\RBAC
MSExchange ADAccess\Topology
MSExchange ADAccess\Validation
I searched and couldn’t find a script to report on the logging level as I wanted it or to reset the levels, so I came up with my own.
This one reports all services that are not set to lowest:
$exchangeservers = get-exchangeserver | ?{$_.IsE14OrLater -eq 'True'}; foreach ($exchangeserver in $exchangeservers){Get-EventLogLevel -Server $exchangeserver | ?{$_.EventLevel -ne "Lowest"}}
Here’s the best bit. This script will set all the Event Log levels back to default:
$exchangeservers = get-exchangeserver | ?{$_.IsE14OrLater -eq 'True'}; foreach ($exchangeserver in $exchangeservers){Get-EventLogLevel -Server $exchangeserver | ?{$_.Identity -like "*\MSExchange*"} | Set-EventLogLevel -Level Lowest -Confirm:$0; Get-EventLogLevel -Server $exchangeserver | ?{$_.Identity -like "*\MSExchange ADAccess\Topology"} | Set-EventLogLevel -Level Low -Confirm:$0 ; Get-EventLogLevel -Server $exchangeserver | ?{$_.Identity -like "*\MSExchange ADAccess\Validation"} | Set-EventLogLevel -Level Low -Confirm:$0 ; Get-EventLogLevel -Server $exchangeserver| ?{$_.Identity -like "*\MSExchange RBAC\RBAC"} | Set-EventLogLevel -Level Low -Confirm:$0}