First retrieve what is currently logged on a specific server. You can retrieve this information as follows : Get-EventLoglevel -server Servername This will retrieve a list similar to this : MSExchange ActiveSync\Requests Lowest MSExchange ActiveSync\Configuration Lowest MSExchange Antispam\General Lowest MSExchange Assistants\Assistants Lowest MSExchange Autodiscover\Core Lowest MSExchange Autodiscover\Web Lowest MSExchange Autodiscover\Provider Lowest MSExchange Availability\Availability Service Lowest ...