Exchange Server 2010 Mailbox Audit Loglarını Raporlamak için PowerShell Script

closeBu yazı 2 yıl 4 ay 30 gün önce yayınlanmış olduğundan güncelliğini yitirmiş veya içeriğindeki bilgilerin geçerliliği kaybolmuş olabilir. Herhangi bir yanlış anlaşılmadan bu site sorumlu değildir.

Technet Script Repository`de yayınladığım Mailbox Audit Logları için kullanabileceğiniz raporlama PowerShell scriptimi sizlerle paylaşmak istedim.

Bu raporlama powershell scriptini buradan indirebilirsiniz.

This script creates a HTML Report to show Mailbox Audit Logs for a single Exchange 2010 Mailbox or all AuditEnabled Mailboxes.

For more information about Mailbox Audit Logging please visit: Understanding Mailbox Audit Logging: Exchange 2010 Help

 

PARAMETER Mailbox

If you want to report a single mailbox use “Mailbox” parameter.

SWITCH All

If you want to report all AuditEnabled mailboxes use “All” switch. This will create a report for each mailbox. If you have 60 users Mailbox Audit Enabled you will get 1 report for each user in total 60 reports.

SWITCH UniqueFileName

If you use UniqueFileName switch the output name will be “SAMAccountName-DayMonthYear-HourMinuteSecond.html” (Example: srknvrgl-15032012-163420.html)

Notes

  • Please make sure you have write permission on the folder that you are running the script from.
  • If you use All switch and Mailbox Parameter at the same time. Only All switch will be used.
  • By default the report will be generated as “SAMAccountName.html” (Example: srknvrgl.html)in the directory that you ran the script from.
  • If you are running the script in scheduled intervals you might want to use UniqueFileName switch to keep all versions if not the report will be overridden.
  • Accounts with Audit Bypass Association Enabled will also be listed on these reports just incase.
  • I did not want to make it look too crowded so only showing the most needed information at the moment if you need to see more information please contact me and I will update the script to show information you need as well.
  • The maximum limit of items that will be reported in a single report: 250000
  • This script is using Search-MailboxAuditLog command and will not show item subjects for deletion operations. If you want to see the subject of the item please use ECP to get a non owner report.

Examples

For a Single Mailbox

.\Report-MailboxAuditLog -Mailbox srknvrgl
For all AuditEnabled Mailboxes
.\Report-MailboxAuditLog -All
For a Single Mailbox with Unique File Name Output
.\Report-MailboxAuditLog -Mailbox srknvrgl -UniqueFileName
For all mailboxes with Unique File Name Output
.\Report-MailboxAuditLog -All -UniqueFileName

Feel free to ask questions in Q and A or contact me directly @srknvrgl

Yayınlayan: Serkan Varoğlu

Yıldız Teknik Üniversitesi Elektrik Mühendisliğini bitirdim. Türkiye'de birçok farklı sektör ve firmada Sistem Yöneticiği yaptım. Şu anda Bermudada Independent Consulting Solutions firmasında Senior Consultant olarak kariyerime devam ediyorum. 2012 yılında Exchange Server MVP ödülüne layık görüldüm. Sahip olduğum sertifikalar: MCSE/2000-2003, MCSA/2000,2003, MCITP: Enterprise Administrator, MCITP: Enterprise Messaging Administrator 2010, ITILv3 Foundation.