[EXO][PS] Audit Log Search for Sign Mailbox

Audit Log Search

[crayon-67ee7786e4b0e144984891 inline=”true” ]
connect-exchangeonline

$mbx = “joe@someaddress.com” 
$StartDate = (Get-Date).AddDays(-90); $EndDate = (Get-Date) 
$Records = (Search-UnifiedAuditLog -StartDate $StartDate -EndDate $EndDate -FreeText (Get-Mailbox $mbx).ExchangeGuid -resultsize 20)

If (!($Records)) { Write-Host “No records found.”; break } 
Else { 
 Write-Host “Processing” $Records.Count “audit records…” 
 #$Report = [System.Collections.Generic.List[Object]]::new() # Create output file  
 $report = @()
 ForEach ($Rec in $Records) { 
    $AuditData = ConvertFrom-Json $Rec.Auditdata 
    If ($AuditData.ResultStatus -eq “PartiallySucceeded”) {
        $EMailSubjects = “*** Not deleted by” + $AuditData.ClientInfoString + ” ***” }
    Else {
        $EmailSubjects = $AuditData.AffectedItems.Subject -join “, ” }

   

    $ReportLine = [PSCustomObject] @{ 
      TimeStamp          = Get-Date($AuditData.CreationTime) -format g 
      User               = $AuditData.UserId 
      Action             = $AuditData.Operation 
      Test          = $Rec.operations
      Status             = $AuditData.ResultStatus 
      Mailbox            = $AuditData.MailboxOwnerUPN 
      “Message Subjects” = $EmailSubjects
      Folder             = $AuditData.Folder.Path.Split(“\”)[1] 
      Client             = $AuditData.ClientInfoString } 


      $reportline
    $Report.Add($ReportLine) 
    echo $test
    }
  } 
  echo $report
$Report | Sort Mailbox | Select Timestamp, Test, Action, User, Mailbox, “Message Subjects”, Folder | Out-GridView
#>

[crayon–67ee7786e4b0e144984891 inline=“true” ]

connect–exchangeonline

$mbx = “joe@someaddress.com”

$StartDate = (Get–Date).AddDays(–90); $EndDate = (Get–Date)

$Records = (Search–UnifiedAuditLog –StartDate $StartDate –EndDate $EndDate –FreeText (Get–Mailbox $mbx).ExchangeGuid –resultsize 20)

If (!($Records)) { Write–Host “No records found.”; break }

Else {

Write–Host “Processing” $Records.Count “audit records…”

#$Report = [System.Collections.Generic.List[Object]]::new() # Create output file

$report = @()

ForEach ($Rec in $Records) {

$AuditData = ConvertFrom–Json $Rec.Auditdata

If ($AuditData.ResultStatus –eq “PartiallySucceeded”) {

$EMailSubjects = “*** Not deleted by” + $AuditData.ClientInfoString + ” ***” }

Else {

$EmailSubjects = $AuditData.AffectedItems.Subject –join “, “ }

$ReportLine = [PSCustomObject] @{

TimeStamp = Get–Date($AuditData.CreationTime) –format g

User = $AuditData.UserId

Action = $AuditData.Operation

Test = $Rec.operations

Status = $AuditData.ResultStatus

Mailbox = $AuditData.MailboxOwnerUPN

“Message Subjects” = $EmailSubjects

Folder = $AuditData.Folder.Path.Split(“\”)[1]

Client = $AuditData.ClientInfoString }

$reportline

$Report.Add($ReportLine)

echo $test

}

echo $report

$Report | Sort Mailbox | Select Timestamp, Test, Action, User, Mailbox, “Message Subjects“, Folder | Out–GridView

[/crayon]

epic

test Exchange Administrator Tecism

https://www.hiepic.com

theelau@gmail.com

415-000-0000

Sorry! The Author has not filled his profile.