Exchange Server 2010 Mailbox Audit Loglarını Raporlamak için PowerShell Script

closeBu yazı 2 yıl 7 ay 1 gün önce yayınlanmış olduğundan güncelliğini yitirmiş veya içeriğindeki bilgilerin geçerliliği kaybolmuş olabilir. Herhangi bir yanlış anlaşılmadan bu site sorumlu değildir.

Technet Script Repository`de yayınladığım Mailbox Audit Logları için kullanabileceğiniz raporlama PowerShell scriptimi sizlerle paylaşmak istedim.

Bu raporlama powershell scriptini buradan indirebilirsiniz.

This script creates a HTML Report to show Mailbox Audit Logs for a single Exchange 2010 Mailbox or all AuditEnabled Mailboxes.

For more information about Mailbox Audit Logging please visit: Understanding Mailbox Audit Logging: Exchange 2010 Help

 

PARAMETER Mailbox

If you want to report a single mailbox use “Mailbox” parameter.

SWITCH All

If you want to report all AuditEnabled mailboxes use “All” switch. This will create a report for each mailbox. If you have 60 users Mailbox Audit Enabled you will get 1 report for each user in total 60 reports.

SWITCH UniqueFileName

If you use UniqueFileName switch the output name will be “SAMAccountName-DayMonthYear-HourMinuteSecond.html” (Example: srknvrgl-15032012-163420.html)

Notes

  • Please make sure you have write permission on the folder that you are running the script from.
  • If you use All switch and Mailbox Parameter at the same time. Only All switch will be used.
  • By default the report will be generated as “SAMAccountName.html” (Example: srknvrgl.html)in the directory that you ran the script from.
  • If you are running the script in scheduled intervals you might want to use UniqueFileName switch to keep all versions if not the report will be overridden.
  • Accounts with Audit Bypass Association Enabled will also be listed on these reports just incase.
  • I did not want to make it look too crowded so only showing the most needed information at the moment if you need to see more information please contact me and I will update the script to show information you need as well.
  • The maximum limit of items that will be reported in a single report: 250000
  • This script is using Search-MailboxAuditLog command and will not show item subjects for deletion operations. If you want to see the subject of the item please use ECP to get a non owner report.

Examples

For a Single Mailbox

.\Report-MailboxAuditLog -Mailbox srknvrgl
For all AuditEnabled Mailboxes
.\Report-MailboxAuditLog -All
For a Single Mailbox with Unique File Name Output
.\Report-MailboxAuditLog -Mailbox srknvrgl -UniqueFileName
For all mailboxes with Unique File Name Output
.\Report-MailboxAuditLog -All -UniqueFileName

Feel free to ask questions in Q and A or contact me directly @srknvrgl

Yayınlayan: Serkan Varoğlu

Yıldız Teknik Üniversitesi Elektrik Mühendisliğini bitirdim. Türkiye'de birçok farklı sektör ve firmada Sistem Yöneticiği yaptım. Bermudada 3 yıla yakın danışmanlık yaptıktan sonra şu anda İrlanda'da çalışma hayatıma devam ediyorum.