External/powershell-scripts
1
0
Fork 0
mirror of https://github.com/admindroid-community/powershell-scripts.git synced 2025-12-17 16:35:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

Get mailboxes' non-audited actions

Browse Source 
Get mailboxes' non-audited actions
This commit is contained in:
AdminDroid 2023-09-28 12:41:31 +05:30
parent d09ef0cdb5
commit c91e3174a2
1 changed files with 18 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
Export Non-audited Mailbox Actions/GetMB_NonAuditedActions.ps1
View File

@ -4,7 +4,17 @@ Name: Export Exchange Online Non-audited mailbox Activities
Description: This script exports non-audited mailbox activities to CSV file Description: This script exports non-audited mailbox activities to CSV file
Version: 1.0 Version: 1.0
Website: o365reports.com Website: o365reports.com
Script by: O365Reports Team
Script Highlights:
~~~~~~~~~~~~~~~~~
1. The script uses modern authentication to connect to Exchange Online.
2. The script can be executed with MFA enabled account.
3. Exports the report result to a CSV file.
4. Lists the non-audited mailbox actions for each logon type (Admin, Owner, Delegate).
5. Helps to identify audit bypassed mailboxes.
6. Automatically installs the EXO V2 module (if not installed already) upon your confirmation.
7. Credentials are passed as parameters (scheduler-friendly), so worry not! i.e., credentials can be passed as parameters rather than being saved inside the script.
For detailed script execution: https://o365reports.com/2022/05/31/identify-non-audited-mailbox-activities-and-take-necessary-actions For detailed script execution: https://o365reports.com/2022/05/31/identify-non-audited-mailbox-activities-and-take-necessary-actions
============================================================================================ ============================================================================================
#> #>
@ -43,7 +53,7 @@ function Connect_Exo {
else { else {
Connect-ExchangeOnline Connect-ExchangeOnline
} }
Write-Host "ExchangeOnline PowerShell module is connected successfully" Write-Host "ExchangeOnline PowerShell module is connected successfully"`n
} }
$global:ExportCSVFileName = "Mailboxes_NonAuditingActions_Report_" + ((Get-Date -format "MMM-dd hh-mm-ss tt").ToString()) + ".csv" $global:ExportCSVFileName = "Mailboxes_NonAuditingActions_Report_" + ((Get-Date -format "MMM-dd hh-mm-ss tt").ToString()) + ".csv"
function MailboxNotAudited { function MailboxNotAudited {
@ -90,7 +100,12 @@ function MailboxNotAudited {
Connect_Exo Connect_Exo
MailboxNotAudited MailboxNotAudited
if ((Test-Path -Path $global:ExportCSVFileName) -eq "True") { if ((Test-Path -Path $global:ExportCSVFileName) -eq "True") {
Write-Host "Mailboxes and disabled auditing actions are exported. The report available in `"$global:ExportCSVFileName`"" -ForegroundColor Green Write-Host "Mailboxes and disabled auditing actions are exported"`n
Write-Host " The report available in:" -NoNewline -ForegroundColor Yellow; Write-Host .\$global:ExportCSVFileName `n
Write-Host "Disconnected active ExchangeOnline session"
Write-Host `n~~ Script prepared by AdminDroid Community ~~`n -ForegroundColor Green
Write-Host "~~ Check out " -NoNewline -ForegroundColor Green; Write-Host "admindroid.com" -ForegroundColor Yellow -NoNewline;
Write-Host " to get access to 1800+ Microsoft 365 reports. ~~" -ForegroundColor Green `n`n
$prompt = New-Object -ComObject wscript.shell $prompt = New-Object -ComObject wscript.shell
$userInput = $prompt.popup("Do you want to open output files?", 0, "Open Output File", 4) $userInput = $prompt.popup("Do you want to open output files?", 0, "Open Output File", 4)
if ($userInput -eq 6) { if ($userInput -eq 6) {
@ -98,4 +113,3 @@ if ((Test-Path -Path $global:ExportCSVFileName) -eq "True") {
} }
} }
Disconnect-ExchangeOnline -Confirm:$false -InformationAction Ignore -ErrorAction SilentlyContinue Disconnect-ExchangeOnline -Confirm:$false -InformationAction Ignore -ErrorAction SilentlyContinue
Write-Host "Disconnected active ExchangeOnline session"