PowerShell 审计Office365 邮箱操作日志

PowerShell 审计Office365 邮箱操作日志

Office365 里面，我们可以Get-MessageTrace 来追踪邮件收发的记录，但是针对具体某一个邮箱，如何获取相关操作的信息呢, 比如谁删除，移动了某些邮件？尤其是一些邮箱可能多人都有权限访问，然后某个邮件找不着的情况下，如何来追踪操作日志？

微软官方提供了一个文档和PowerShell进行相关的操作。([PARAMETER(Mandatory=$TRUE,ValueFromPipeline=$FALSE)] [string]$Mailbox, [PARAMETER(Mandatory=$TRUE,ValueFromPipeline=$FALSE)] [string]$StartDate, [PARAMETER(Mandatory=$TRUE,ValueFromPipeline=$FALSE)] [string]$EndDate, [PARAMETER(Mandatory=$FALSE,ValueFromPipeline=$FALSE)] [string]$Subject, [PARAMETER(Mandatory=$False,ValueFromPipeline=$FALSE)] [switch]$IncludeFolderBind, [PARAMETER(Mandatory=$False,ValueFromPipeline=$FALSE)] [switch]$ReturnObject) BEGIN { [string[]]$LogParameters = @('Operation', 'LogonUserDisplayName', 'LastAccessed', 'DestFolderPathName', 'FolderPathName', 'ClientInfoString', 'ClientIPAddress', 'ClientMachineName', 'ClientProcessName', 'ClientVersion', 'LogonType', 'MailboxResolvedOwnerName', 'OperationResult') } END { if ($ReturnObject) {return $SearchResults} elseif ($SearchResults.count -gt 0) { $Date = get-date -Format yyMMdd_HHmmss $OutFileName = "AuditLogResults$Date.csv" write-host write-host -fore green 'Posting results to file: $OutfileName' $SearchResults | export-csv $OutFileName -notypeinformation -encoding UTF8 } } PROCESS { write-host -fore green 'Searching Mailbox Audit Logs...' $SearchResults = @(search-mailboxAuditLog $Mailbox -StartDate $StartDate -EndDate $EndDate -LogonTypes Owner, Admin, Delegate -ShowDetails -resultsize 50000) write-host -fore green '$($SearchREsults.Count) Total entries Found' if (-not $IncludeFolderBind) { write-host -fore green 'Removing FolderBind operations.' $SearchResults = @($SearchResults | ? {$_.Operation -notlike 'FolderBind'}) write-host -fore green 'Filtered to $($SearchREsults.Count) Entries' } $SearchResults = @($SearchResults | select ($LogParameters + @{Name='Subject';e={if (($_.SourceItems.Count -eq 0) -or ($_.SourceItems.Count -eq $null)){$_.ItemSubject} else {($_.SourceItems[0].SourceItemSubject).TrimStart(' ')}}}, @{Name='CrossMailboxOp';e={if (@('SendAs','Create','Update') -contains $_.Operation) {'N/A'} else {$_.CrossMailboxOperation}}})) $LogParameters = @('Subject') + $LogParameters + @('CrossMailboxOp') If ($Subject -ne '' -and $Subject -ne $null) { write-host -fore green 'Searching for Subject: $Subject' $SearchResults = @($SearchResults | ? {$_.Subject -match $Subject -or $_.Subject -eq $Subject}) write-host -fore green 'Filtered to $($SearchREsults.Count) Entries' } $SearchResults = @($SearchResults | select $LogParameters) }

执行之后 会自动生成对应的Excel文档, 谁在什么时候，从什么客户端的IP，做了什么操作一目了然

版权声明：本文内容由网络用户投稿，版权归原作者所有，本站不拥有其著作权，亦不承担相应法律责任。如果您发现本站中有涉嫌抄袭或描述失实的内容，请联系我们jiasou666@gmail.com 处理，核实后本网站将在24小时内删除侵权内容。