OK, so I found a mailbox attribute changed on a mailbox and I want to know who changed this when.
So I started looking in the MSExchange Management log in Event Viewer and am thinking I could search that using powershell and tell it to search the Event Data.
Anyone have any advanced searching notes beyond:
Get-EventLog Application | where {$_.EventId -eq 1309} | Format-Table -autosize;Jason Meyer