External/powershell-scripts
1
0
Fork 0
mirror of https://github.com/admindroid-community/powershell-scripts.git synced 2025-12-17 16:35:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

Audit Deleted Emails in Office 365

Browse Source 
Audit Deleted Emails in Office 365
This commit is contained in:
AdminDroid 2021-09-23 19:10:30 +05:30
parent 4cad95a49d
commit a5bc88c4fe
1 changed files with 11 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
Audit Email Deletion in Office 365/AuditDeletedEmails.ps1
View File

@ -1,4 +1,12 @@
 <#
=============================================================================================
Name: Audit Email Deletion in Office 365
Description: This script exports deleted emails audit records to CSV
website: o365reports.com
Script by: O365Reports Team
For detailed Script execution: https://o365reports.com/2021/09/02/audit-email-deletion-in-office-365-mailbox-powershell
============================================================================================
#>
Param Param
( (
[Parameter(Mandatory = $false)] [Parameter(Mandatory = $false)]
@ -140,7 +148,7 @@ while($true)
$ResultCount=0 $ResultCount=0
#Getting email deleted audit data for given time range #Getting email deleted audit data for given time range
Search-UnifiedAuditLog -StartDate $CurrentStart -EndDate $CurrentEnd -Operations $RetriveOperation -SessionId s -SessionCommand ReturnLargeSet -ResultSize 5000 | ForEach-Object { Search-UnifiedAuditLog -StartDate $CurrentStart -EndDate $CurrentEnd -Operations $RetriveOperation -SessionId s -SessionCommand ReturnLargeSet -ResultSize 5000 | ForEach-Object {
$currentResultCount=$CurrentResultCount+$ResultCount
$ResultCount++ $ResultCount++
$ProcessedAuditCount++ $ProcessedAuditCount++
Write-Progress -Activity "`n Retrieving email deletion activities from $CurrentStart to $CurrentEnd.."`n" Processed audit record count: $ProcessedAuditCount" Write-Progress -Activity "`n Retrieving email deletion activities from $CurrentStart to $CurrentEnd.."`n" Processed audit record count: $ProcessedAuditCount"
@ -181,7 +189,7 @@ while($true)
$ExportResults= New-Object PSObject -Property $ExportResult $ExportResults= New-Object PSObject -Property $ExportResult
$ExportResults | Select-Object 'Activity Time','Activity','Target Mailbox','Performed By','No. of Emails Deleted','Email Subjects','Folder','Result Status','More Info' | Export-Csv -Path $OutputCSV -Notype -Append $ExportResults | Select-Object 'Activity Time','Activity','Target Mailbox','Performed By','No. of Emails Deleted','Email Subjects','Folder','Result Status','More Info' | Export-Csv -Path $OutputCSV -Notype -Append
} }
$currentResultCount=$CurrentResultCount+$ResultCount
if($CurrentResultCount -ge 50000) if($CurrentResultCount -ge 50000)
{ {
Write-Host Retrieved max record for current range.Proceeding further may cause data loss or rerun the script with reduced time interval. -ForegroundColor Red Write-Host Retrieved max record for current range.Proceeding further may cause data loss or rerun the script with reduced time interval. -ForegroundColor Red
@ -246,12 +254,6 @@ else
} }
} }
} }
<#
=============================================================================================
For detailed Script execution: https://o365reports.com/2021/09/02/audit-email-deletion-in-office-365-mailbox-powershell
============================================================================================
#>
#Disconnect Exchange Online session #Disconnect Exchange Online session
Disconnect-ExchangeOnline -Confirm:$false -InformationAction Ignore -ErrorAction SilentlyContinue Disconnect-ExchangeOnline -Confirm:$false -InformationAction Ignore -ErrorAction SilentlyContinue