Audit Log Search
connect-exchangeonline
$mbx = "joe@someaddress.com"
$StartDate = (Get-Date).AddDays(-90); $EndDate = (Get-Date)
$Records = (Search-UnifiedAuditLog -StartDate $StartDate -EndDate $EndDate -FreeText (Get-Mailbox $mbx).ExchangeGuid -resultsize 20)
If (!($Records)) { Write-Host "No records found."; break }
Else {
Write-Host "Processing" $Records.Count "audit records..."
#$Report = [System.Collections.Generic.List[Object]]::new() # Create output file
$report = @()
ForEach ($Rec in $Records) {
$AuditData = ConvertFrom-Json $Rec.Auditdata
If ($AuditData.ResultStatus -eq "PartiallySucceeded") {
$EMailSubjects = "*** Not deleted by" + $AuditData.ClientInfoString + " ***" }
Else {
$EmailSubjects = $AuditData.AffectedItems.Subject -join ", " }
$ReportLine = [PSCustomObject] @{
TimeStamp = Get-Date($AuditData.CreationTime) -format g
User = $AuditData.UserId
Action = $AuditData.Operation
Test = $Rec.operations
Status = $AuditData.ResultStatus
Mailbox = $AuditData.MailboxOwnerUPN
"Message Subjects" = $EmailSubjects
Folder = $AuditData.Folder.Path.Split("\")[1]
Client = $AuditData.ClientInfoString }
$reportline
$Report.Add($ReportLine)
echo $test
}
}
echo $report
$Report | Sort Mailbox | Select Timestamp, Test, Action, User, Mailbox, "Message Subjects", Folder | Out-GridView
#>
Sorry! The Author has not filled his profile.