I would like to know when an administrator adds, changes or deletes a transport rule and who the user was that made the change.When a new transport rule is loaded by a Hub Transport server, anapplication event4002 is logged. This event doesn't specify what the change. Changing the logging level of MSExchange Messaging Policies\Rules did not produce any more information.Does anyone know how to do this?Exchange 2007 SP1.

So what you want to know is all info of the change that happens to the transport rules, right? Per my knowledge, theres no method to tell who has changed the transport rules We can only use the time when the rule got modified (Event 4002) and then depending on that we can cross-check which admin account has logged in during that period of time In the EMC, we can add Last Modified Time column (From View menu) to Transport rules pane, after comparing that time with the logged time of event 4002, we can know which rule has been changed