system:
  provider: MSExchange CmdletLogs
  guid: ''
  event_source_name: ''
  event_id: 6
  version: 0
  level: 2
  task: 1
  opcode: 0
  keywords: 36028797018963968
  time_created: '2021-06-04T08:43:08.546589+00:00'
  event_record_id: 7187
  correlation: {}
  execution:
    process_id: 0
    thread_id: 0
  channel: MSExchange Management
  computer: exchange01.offsec.lan
  security:
    user_id: ''
event_data:
  Data:
  - Enable-TransportAgent
  - -Identity "hack"
  - offsec.lan/OFFSEC-COMPANY/Administrators/admmig
  - S-1-5-21-4230534742-2542757381-3142984815-1111
  - S-1-5-21-4230534742-2542757381-3142984815-1111
  - Remote-ManagementShell-Unknown
  - 8372 w3wp#MSExchangePowerShellAppPool
  - ''
  - '54'
  - '00:00:00.0700039'
  - 'View Entire Forest: ''False'', Default Scope: ''offsec.lan'', Configuration Domain
    Controller: ''rootdc1.offsec.lan'', Preferred Global Catalog: ''rootdc1.offsec.lan'',
    Preferred Domain Controllers: ''{ rootdc1.offsec.lan }'''
  - "System.ArgumentException: Transport agent \"hack\" isn't found.\r\nParameter
    name: Identity\r\n   at Microsoft.Exchange.Configuration.Tasks.Task.ThrowError(Exception
    exception, ErrorCategory errorCategory, Object target, String helpUrl)\r\n   at
    Microsoft.Exchange.Management.AgentTasks.AgentBaseTask.SetAgentEnabled(String
    identity, Boolean enabled)\r\n   at Microsoft.Exchange.Management.AgentTasks.EnableTransportAgent.InternalProcessRecord()\r\n
    \  at Microsoft.Exchange.Configuration.Tasks.Task.<ProcessRecord>b__91_1()\r\n
    \  at Microsoft.Exchange.Configuration.Tasks.Task.InvokeRetryableFunc(String funcName,
    Action func, Boolean terminatePipelineIfFailed)"
  - '5'
  - ''
  - NonLocalizedException
  - ''
  - ''
  - 'False'
  - ''
  - 0 objects execution has been proxied to remote server.
  - ''
  - ''
  - '0'
  - 'ActivityId: 51b67026-685e-41b9-ad71-bc1e46db849b'
  - ServicePlan:;IsAdmin:True;
  - ''
  - en-US
message: ''