An Engineers Notebook

Office 365: Audit and tracking (Power Shell)

Enable Auditing for a specific Mailbox

Set-Mailbox [email protected] -AuditEnabled $true

Enable mailbox auditing for all users

$UserMailboxes = Get-Mailbox -Filter {(RecipientTypeDetails -eq 'UserMailbox')}
$UserMailboxes | ForEach {Set-Mailbox $_.Identity -AuditEnabled $true

View Configuration Settings for current administrator audit logging

Get-AdminAuditLogConfig

Add comments to administrator log

Write-AdminAuditLog

Search content of administrator audit log

Search-AdminAuditLog OR New-AdminAuditLogSearch

For a simplified view

Search-AdminAuditLog | fl Caller,RunDate,ObjectModified,CmdletName

View Accounts the bypass mailbox audit logging
Get-MailboxAuditBypassAssociation

Specify accounts that bypass mailbox audit logging
Set-MailboxAuditBypassAssociation
Get data from a specific message tracking report

Get-MessageTrackingReport

Find a unique message tracking report using search criteria provided

Search-MessageTrackingReport

View information about open logon session to specified mailbox

Get-LogonStatistics  < Cmdlet has been depricated

View information about the folders in a specific mailbox

Get-MailboxFolderStatistics

View information about a specified Mailbox

Get-MailboxStatistics

View information about the total number of recipients in the organization

Get-RecipientStatisticsReport

Leave a Reply

Your email address will not be published.