diff --git a/Office 365 Non-owner Mailbox Access Report/NonOwnerMBAccessReport.ps1 b/Office 365 Non-owner Mailbox Access Report/NonOwnerMBAccessReport.ps1 index c8f2e5b..e9bad28 100644 --- a/Office 365 Non-owner Mailbox Access Report/NonOwnerMBAccessReport.ps1 +++ b/Office 365 Non-owner Mailbox Access Report/NonOwnerMBAccessReport.ps1 @@ -4,6 +4,7 @@ Name: Export Non-Owner Mailbox Access Report Version: 2.0 Website: o365reports.com + Script Highlights: ~~~~~~~~~~~~~~~~~~ @@ -15,6 +16,16 @@ Script Highlights: 6.The script supports Certificate-based authentication too. For detailed script execution: https://o365reports.com/2020/02/04/export-non-owner-mailbox-access-report-to-csv/ + + + +Change Log +~~~~~~~~~~ + + V1.0 (Feb 17, 2020) - File created + V1.1 (Oct 06, 2023) - Minor changes + V2.0 (Nov 25, 2023) - Added certificate-based authentication support to enhance scheduling capability + V2.1 (Sep 24, 2024) - Special handling done to track send as and send-on-behalf activities accurately. ============================================================================================ #> @@ -101,7 +112,7 @@ $OutputCSV=".\NonOwner-Mailbox-Access-Report_$((Get-Date -format yyyy-MMM-dd-ddd $IntervalTimeInMinutes=1440 #$IntervalTimeInMinutes=Read-Host Enter interval time period '(in minutes)' $CurrentStart=$StartDate $CurrentEnd=$CurrentStart.AddMinutes($IntervalTimeInMinutes) -$Operation='ApplyRecord','Copy','Create','FolderBind','HardDelete','MessageBind','Move','MoveToDeletedItem','RecordDelete','SendAs','SendOnBehalf','SoftDelete','Update','UpdateCalendarDelegation','UpdateFolderPermissions','UpdateInboxRules' +$Operation='ApplyRecord','Copy','Create','FolderBind','HardDelete','MessageBind','Move','MoveToDeletedItems','RecordDelete','SendAs','SendOnBehalf','SoftDelete','Update','UpdateCalendarDelegation','UpdateFolderPermissions','UpdateInboxRules' #Check whether CurrentEnd exceeds EndDate(checks for 1st iteration) @@ -168,12 +179,12 @@ while($true) if($AuditData.Operation -eq "SendAs") { $AccessedMB=$AuditData.SendAsUserSMTP - $AccessedBy=$AuditData.MailboxOwnerUPN + $AccessedBy=$AuditData.UserId } elseif($AuditData.Operation -eq "SendOnBehalf") { $AccessedMB=$AuditData.SendOnBehalfOfUserSmtp - $AccessedBy=$AuditData.MailboxOwnerUPN + $AccessedBy=$AuditData.UserId } else { @@ -185,15 +196,16 @@ while($true) Continue } $NonOwnerAccess++ - $AllAudits=@{'Access Time'=$AuditData.CreationTime;'Accessed by'=$AccessedBy;'Performed Operation'=$AuditData.Operation;'Accessed Mailbox'=$AccessedMB;'Logon Type'=$LogonType;'Result Status'=$AuditData.ResultStatus;'External Access'=$AuditData.ExternalAccess} + $AllAudits=@{'Access Time'=$AuditData.CreationTime;'Accessed by'=$AccessedBy;'Performed Operation'=$AuditData.Operation;'Accessed Mailbox'=$AccessedMB;'Logon Type'=$LogonType;'Result Status'=$AuditData.ResultStatus;'External Access'=$AuditData.ExternalAccess;'More Info'=$Result.auditdata} $AllAuditData= New-Object PSObject -Property $AllAudits - $AllAuditData | Sort 'Access Time','Accessed by' | select 'Access Time','Logon Type','Accessed by','Performed Operation','Accessed Mailbox','Result Status','External Access' | Export-Csv $OutputCSV -NoTypeInformation -Append + $AllAuditData | Sort 'Access Time','Accessed by' | select 'Access Time','Logon Type','Accessed by','Performed Operation','Accessed Mailbox','Result Status','External Access','More Info' | Export-Csv $OutputCSV -NoTypeInformation -Append } } - Write-Progress -Activity "`n Retrieving audit log from $StartDate to $EndDate.."`n" Processed audit record count: $AggregateResults" - #$CurrentResult += $Results + #$CurrentResult += $Results $currentResultCount=$CurrentResultCount+($Results.count) $AggregateResults +=$Results.count + Write-Progress -Activity "`n Retrieving audit log for $CurrentStart : $CurrentResultCount records"`n" Total processed audit record count: $AggregateResults" + if(($CurrentResultCount -eq 50000) -or ($Results.count -lt 5000)) { if($CurrentResultCount -eq 50000) @@ -232,6 +244,10 @@ while($true) } } +Write-Host `n~~ Script prepared by AdminDroid Community ~~`n -ForegroundColor Green +Write-Host "~~ Check out " -NoNewline -ForegroundColor Green; Write-Host "admindroid.com" -ForegroundColor Yellow -NoNewline; Write-Host " to get access to 1800+ Microsoft 365 reports. ~~" -ForegroundColor Green `n`n + + If($AggregateResults -eq 0) { Write-Host No records found @@ -244,9 +260,7 @@ else { Write-Host `nThe Output file available in: -NoNewline -ForegroundColor Yellow Write-Host $OutputCSV - Write-Host `n~~ Script prepared by AdminDroid Community ~~`n -ForegroundColor Green - Write-Host "~~ Check out " -NoNewline -ForegroundColor Green; Write-Host "admindroid.com" -ForegroundColor Yellow -NoNewline; Write-Host " to get access to 1800+ Microsoft 365 reports. ~~" -ForegroundColor Green `n`n - $Prompt = New-Object -ComObject wscript.shell + $Prompt = New-Object -ComObject wscript.shell $UserInput = $Prompt.popup("Do you want to open output file?",` 0,"Open Output File",4) If ($UserInput -eq 6)