New Post has been published on o365info.com
New Post has been published on http://o365info.com/manage-mailbox-audit-using-powershell/
Manage Mailbox Audit using PowerShell
The Audit mailbox option is a very useful feature that enables us to get detailed information about all the operations, and the activities related to the “Mailbox” object. Generally speaking, there are couples of “audit type.” In this article, I would like to focus upon the audit type described as: “Non-Owner Mailbox Access.” This option enables us to get detailed information about: who did what and when relating to a specific mailbox.
Table of content
1 – Enable/Disable Mailbox Audit ( Non-Owner Mailbox Access Report )
2 – Set the Type of Mailbox Audit + the required information
3 – Display information about Audit settings
4 – Display information about mailbox and folder permissions
5 – Search for information in the Audit Log
6 – Audit General Settings
7 – Download PowerShell menu script
PowerShell | Help & additional information
In case that you are a novice in the PowerShell environment, you can use the following link to get more information about the “first steps” such as: downloading the required PowerShell software components, how to use the PowerShell console, running a PowerShell script, etc.
Read more
Link Table
PowerShell Naming Conventions & general information
If you want to get more information about the Naming Conventions that we use for this article and get some general tips about: how to work with the PowerShell, read the article: Help and additional information – o365info.com PowerShell articles
Create remote PowerShell session
Before we can use the required PowerShell commands, we need to download and install the Office 365 cmdlets + create remote PowerShell session to Office 365 or Exchange Online. If you need more information about how to create a remote PowerShell session read the following articles: Part 2: Connect to Office 365 by using Remote PowerShell and Part 3: Connect to Exchange Online by using Remote PowerShell
How to use a PowerShell script
Most of the PowerShell articles include a PowerShell script that simplifies the use of the PowerShell commands. If you want to get more information about: How to use a PowerShell script, read the article: Connect to Office 365 and Exchange Online using a script
PowerShell command and Script languish in more details
If you are new to the PowerShell world, you can read more information about PowerShell in Office 365 environment in the article: The Power of PowerShell
Expand All Headers Collapse All Headers
1 - Enable/Disable Mailbox Audit ( Non-Owner Mailbox Access Report )
Enable Mailbox Audit (Non-Owner Mailbox Access Report) for a specific mailbox
PowerShell command Syntax
Set-Mailbox <Identity> -AuditEnabled $True
PowerShell command Example
Set-Mailbox John-AuditEnabled $True
Enable Mailbox Audit (Non-Owner Mailbox Access Report) for ALL mailbox’s (Bulk mode)
PowerShell command Syntax
$UserMailboxes = Get-Mailbox -Filter (RecipientTypeDetails -eq 'UserMailbox') $UserMailboxes | ForEach Set-Mailbox $_.Identity -AuditEnabled $True
Disable Mailbox Audit (Non-Owner Mailbox Access Report) for a specific mailbox
PowerShell command Syntax
Set-Mailbox <Identity> -AuditEnabled $False
PowerShell command Example
Set-Mailbox John -AuditEnabled $False
Disable Mailbox Audit (Non-Owner Mailbox Access Report) for ALL mailbox’s (Bulk mode)
PowerShell command Syntax
$UserMailboxes = Get-Mailbox -Filter (RecipientTypeDetails -eq 'UserMailbox') $UserMailboxes | ForEach Set-Mailbox $_.Identity -AuditEnabled $False
2 - Set the Type of Mailbox Audit + Non default Audit operations
Set Mailbox Audit – AuditAdmin
PowerShell command Syntax
Set-Mailbox <Identity> -AuditAdmin <list of operations>
PowerShell command Example
Set-Mailbox John -AuditAdmin Create,FolderBind,SendAs,SendOnBehalf,SoftDelete,HardDelete,Update,Move,MoveToDeletedItems
Set Mailbox Audit – Audit Delegate
PowerShell command Syntax
Set-Mailbox <Identity> –AuditDelegate <list of operations>
PowerShell command Example
Set-Mailbox John -AuditDelegate Create,FolderBind,SendAs,SendOnBehalf,SoftDelete,HardDelete,Update,Move,MoveToDeletedItems
Enable Audit + Set Mailbox Audit for AuditAdmin and AuditDelegate
PowerShell command Syntax
Set-Mailbox John -AuditEnabled $True -AuditDelegate Create,FolderBind,SendAs,SendOnBehalf,SoftDelete,HardDelete,Update,Move,MoveToDeletedItems -AuditAdmin Create,FolderBind,SendAs,SendOnBehalf,SoftDelete,HardDelete,Update,Move,MoveToDeletedItems
3 - Display information about Audit settings
Display information about Audit logging for a specific Mailbox – AuditDelegate
PowerShell command Syntax
Get-Mailbox <Identity> | Select-Object –ExpandProperty AuditDelegate
PowerShell command Example
Get-Mailbox John | Select-Object –ExpandProperty AuditDelegate
Display information about Audit logging for a specific mailbox – AuditAdmin
PowerShell command Syntax
Get-Mailbox <Identity> | Select-Object -ExpandProperty AuditAdmin
PowerShell command Example
Get-Mailbox John | Select-Object -ExpandProperty AuditAdmin
Display information about recipient Audit folder
PowerShell command Syntax
Get-MailboxFolderStatistics <Identity> | ? $_.Name -eq "Audits" -and $_.FolderType -eq "Audits" | FT Identity, ItemsInFolder, FolderSize -AutoSize
PowerShell command Example
Get-MailboxFolderStatistics John | ? $_.Name -eq "Audits" -and $_.FolderType -eq "Audits" | FT Identity, ItemsInFolder, FolderSize -AutoSize
Display information about all of the mailboxes that are Audited
PowerShell command Syntax
Get-Mailbox | Where $_.AuditEnabled -eq “$True”
View administrator Audit logging settings
PowerShell command Syntax
Get-AdminAuditLogConfig
4 - Display information about mailbox and folder permissions
Display information about Audit logging for a specific mailbox – AuditDelegate
PowerShell command Syntax
Get-MailboxFolder <Identity> -GetChildren | Get-MailboxFolderPermission | Where-Object {-not ($_.AccessRights -like '*None*')
PowerShell command Example
Get-MailboxFolder John -GetChildren | Get-MailboxFolderPermission | Where-Object {-not ($_.AccessRights -like '*None*')
5 - Search for information in the Audit Log
Display all the Audit information that was collected for a specific mailbox
PowerShell command Syntax
Search-MailboxAuditLog <Identity> -LogonTypes Admin,Delegate -ShowDetails
PowerShell command Example
Search-MailboxAuditLog John -LogonTypes Admin,Delegate -ShowDetails
Display Audit information for “Send As” activities
PowerShell command Syntax
Search-MailboxAuditLog <Identity> -LogonTypes Admin,Delegate -ShowDetails | Where-Object $_.Operation -eq "Sendas" |select MailboxResolvedOwnerName, LastAccessed, Operation,OperationResult,LogonUserDisplayName,LogonType ,ItemSubject,FolderPathName,InternalLogonType,SourceItemSubjectsList,SourceItemFolderPathNamesList,ClientProcessName,ClientInfoString
PowerShell command Example
Search-MailboxAuditLog John -LogonTypes Admin,Delegate -ShowDetails | Where-Object $_.Operation -eq "Sendas" | Select MailboxResolvedOwnerName, LastAccessed, Operation,OperationResult,LogonUserDisplayName,LogonType ,ItemSubject,FolderPathName,InternalLogonType,SourceItemSubjectsList,SourceItemFolderPathNamesList,ClientProcessName,ClientInfoString
Display Audit information about a mailbox from specific date range
PowerShell command Syntax
Search-MailboxAuditLog <Identity> -LogonTypes Admin,Delegate –StartDate <mm/dd/yy> –EndDate <mm/dd/yy> –ResultSize <Number>
PowerShell command Example
Search-MailboxAuditLog John -LogonTypes Admin,Delegate -StartDate 05/20/2013 -EndDate 05/25/2013 -ResultSize 2000
Display Audit information about a mailbox from specific date range for “HardDelete” activities
PowerShell command Syntax
Search-MailboxAuditLog <Identity> -LogonTypes Admin,Delegate –StartDate –EndDate –ResultSize | Where-Object $_.Operation -eq "HardDelete"
PowerShell command Example
Search-MailboxAuditLog John -LogonTypes Admin,Delegate -StartDate 05/20/2013 -EndDate 05/25/2013 -ResultSize 2000 | Where-Object $_.Operation -eq "HardDelete"
Display the content of the administrator audit log (show all events)
PowerShell command Syntax
Search-AdminAuditLog
Search the contents of the administrator Audit log
PowerShell command Syntax
Search-AdminAuditLog – Cmdlets <cmdlet 1, cmdlet 2, ...> –Parameters <Parameter 1, parameter 2, ...> –StartDate <Start date> –EndDate <End date> –UserIds <user IDs> –ObjectIds <object IDs> -IsSuccess <$True | $False >
PowerShell command Example
Search-MailboxAuditLog John -LogonTypes Admin,Delegate -StartDate 05/20/2014 -EndDate 05/25/2014 -ResultSize 2000 Search-AdminAuditLog -Cmdlets Set-Mailbox -Parameters ProhibitSendQuota, ProhibitSendReceiveQuota, IssueWarningQuota, MaxSendsize, MaxReceiveSize -StartDate 05/20/2014 -EndDate 05/25/2014 -UserIds John,Alice,Bob -IsSuccess $True
Search the contents of the administrator Audit log: look for specific user
PowerShell command Syntax
Search-AdminAuditLog -UserIds <Identity>
PowerShell command Example
Search-AdminAuditLog -UserIds John
6 - Audit General Settings
Configure Outlook Web App to allow XML attachments
PowerShell command Syntax
Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -AllowedFileTypes '.rpmsg','.xlsx','.xlsm','.xlsb','.tiff','.pptx','.pptm','.ppsx','.ppsm','.docx','.docm','.zip','.xls','.wmv','.wma','.wav','.vsd','.txt','.tif','.rtf','.pub','.ppt','.png','.pdf','.one','.mp3','.jpg','.gif','.doc','.bmp','.avi','.xml'
Set Audit retention – number of days
PowerShell command Syntax
Set-Mailbox <Identity> -AuditLogAgeLimit <Days>
PowerShell command Example
Set-Mailbox John -AuditLogAgeLimit 30
Suppressing Audits for Specific Mailboxes
PowerShell command Syntax
Set-MailboxAuditBypassAssociation <Identity> -AuditBypassEnabled $True
PowerShell command Example
Set-MailboxAuditBypassAssociation John -AuditBypassEnabled $True
Search for specific information in the Audit log
PowerShell command Syntax
New-MailboxAuditLogSearch –Name <String> -LogonTypes Admin,Delegate –StartDate –EndDate –StatusMailRecipients <Email Address>
PowerShell command Example
New-MailboxAuditLogSearch -Name "Audit information for all mailboxes" -LogonTypes Admin,Delegate -StartDate 05/20/2014 -EndDate 05/25/2014 -StatusMailRecipients [email protected]
Script Box
For your convenience, I have “Wrapped” all of the PowerShell commands that was reviewed, In a PowerShell Script named: Audit.ps1
Download Script
Additional reading
Search-MailboxAuditLog
Export the Administrator Audit Log
Use Audit Logging to Record User Actions
Use Auditing Reports in Exchange Online
Understanding Mailbox Auditing Reports in Office 365
Run a Non-Owner Mailbox Access Report
Export Mailbox Audit Logs
Mailbox Auditing in Exchange Server 2010
Search the Administrator Audit Log
Now it’s Your Turn! We really want to know what you think about the article