-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy path34-Get-MailboxAuditLog.ps1
221 lines (189 loc) · 12 KB
/
34-Get-MailboxAuditLog.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
# Bitpusher
# \`._,'/
# (_- -_)
# \o/
# The Digital
# Fox
# https://theTechRelay.com
# https://github.com/bitpusher2k
#
# Get-MailboxAuditLog.ps1 - By Bitpusher/The Digital Fox
# v2.8 last updated 2024-05-03
# Script to get the mailbox audit log of specified users, or all users.
#
# Usage:
# powershell -executionpolicy bypass -f .\Get-MailboxAuditLog.ps1 -OutputPath "Default" -UserIds "[email protected]" -DaysAgo "10"
#
# Run with already existing connection to M365 tenant through
# PowerShell modules.
#
# Uses ExchangePowerShell commands.
#
#comp #m365 #security #bec #script #irscript #powershell #mailbox #audit #log
#Requires -Version 5.1
[CmdletBinding()]
param(
[string]$OutputPath,
[string]$UserIds,
[int]$DaysAgo,
[datetime]$StartDate,
[datetime]$EndDate,
[string]$Encoding = "utf8bom" # "ascii","ansi","bigendianunicode","unicode","utf8","utf8","utf8NoBOM","utf32"
)
if ($PSVersionTable.PSVersion.Major -eq 5 -and ($Encoding -eq "utf8bom" -or $Encoding -eq "utf8nobom")) { $Encoding = "utf8" }
try {
$areYouConnected = Search-MailboxAuditlog -ErrorAction stop
} catch {
Write-Output "[WARNING] You must call Connect-M365 before running this script"
break
}
## If OutputPath variable is not defined, prompt for it
if (!$OutputPath) {
Write-Output ""
$OutputPath = Read-Host "Enter the output base path, e.g. $($env:userprofile)\Desktop\Investigation (default)"
If ($OutputPath -eq '') { $OutputPath = "$($env:userprofile)\Desktop\Investigation" }
Write-Output "Output base path will be in $OutputPath"
} elseif ($OutputPath -eq 'Default') {
Write-Output ""
$OutputPath = "$($env:userprofile)\Desktop\Investigation"
Write-Output "Output base path will be in $OutputPath"
}
## If OutputPath does not exist, create it
$CheckOutputPath = Get-Item $OutputPath -ErrorAction SilentlyContinue
if (!$CheckOutputPath) {
Write-Output ""
Write-Output "Output path does not exist. Directory will be created."
mkdir $OutputPath
}
## Get Primary Domain Name for output subfolder
$PrimaryDomain = Get-AcceptedDomain | Where-Object Default -EQ $true
$DomainName = $PrimaryDomain.DomainName
$CheckSubDir = Get-Item $OutputPath\$DomainName -ErrorAction SilentlyContinue
if (!$CheckSubDir) {
Write-Output ""
Write-Output "Domain sub-directory does not exist. Sub-directory `"$DomainName`" will be created."
mkdir $OutputPath\$DomainName
}
## If UserIds variable is not defined, prompt for it
if (!$UserIds) {
Write-Output ""
$UserIds = Read-Host 'Enter the user ID (email address) to retreive mailbox audit log of (leave blank to retirieve for all users - could take a long time)'
}
## If DaysAgo variable is not defined, prompt for it
if (!$DaysAgo) {
Write-Output ""
$DaysAgo = Read-Host 'Enter how many days back to retrieve ALL available Mailbox Audit Log entries (default: 30, maximum: 90)'
if ($DaysAgo -eq '') { $DaysAgo = "30" }
Write-Output "Will attempt to retrieve all UAC entries going back $DaysAgo days from today."
}
if ($DaysAgo -gt 90) { $DaysAgo = "90" }
$StartDate = (Get-Date).AddDays(- $DaysAgo)
$EndDate = (Get-Date).AddDays(1)
$resultSize = 5000 #Maximum number of records that can be retrieved per query
$date = Get-Date -Format "yyyyMMddHHmmss"
Write-Output "Search-MailboxAuditLog is being deprecated by Microsoft in April 2024 (https://aka.ms/AuditCmdletBlog)"
Write-Output "Microsoft has said to use the `"Search-UnifiedAuditLog -RecordType ExchangeItem`" instead."
Write-Output "This script currently uses both queries."
Write-Output "Running Search-MailboxAuditLog and Search-UnifiedAuditLog commands..."
if (($null -eq $UserIds) -or ($UserIds -eq "")) {
Write-Output "No users specified. Getting the Mailbox Audit Log for all users..."
Get-mailbox -resultsize unlimited |
ForEach-Object {
$date = Get-Date -Format "yyyyMMddHHmmss"
$outputFile = "$OutputPath\$DomainName\mailboxAuditLog_$($_.UserPrincipalName)_going_back_$($DaysAgo)_days_from_$($date).csv"
$outputFileUAL = "$OutputPath\$DomainName\mailboxAuditLogUAL_$($_.UserPrincipalName)_going_back_$($DaysAgo)_days_from_$($date).csv"
Write-Output "Collecting the MailboxAuditLog for $($_.UserPrincipalName)"
Write-Output "Search-MailboxAuditlog -Identity $_.UserPrincipalName -LogonTypes Delegate,Admin,Owner -StartDate $StartDate -EndDate $EndDate -ShowDetails -ResultSize 250000"
$result = Search-MailboxAuditlog -Identity $_.UserPrincipalName -LogonTypes Delegate, Admin, Owner -StartDate $StartDate -EndDate $EndDate -ShowDetails -resultsize 250000
$result | Export-Csv -NoTypeInformation -Path $outputFile -Encoding $Encoding -Append
$sesid = Get-Random # Get random session number
Write-Output "Search-UnifiedAuditLog -RecordType ExchangeItem -UserIds $_.UserPrincipalName -StartDate $StartDate -EndDate $EndDate -SessionId $sesid -SessionCommand ReturnLargeSet -ResultSize $resultSize"
$count = 1
do {
Write-Output "Getting unified audit logs page $count - Please wait"
try {
$currentOutput = Search-UnifiedAuditLog -RecordType ExchangeItem -UserIds $_.UserPrincipalName -StartDate $StartDate -EndDate $EndDate -SessionId $sesid -SessionCommand ReturnLargeSet -ResultSize $resultSize
} catch {
Write-Output "`n[002] - Search Unified Log error. Typically not connected to Exchange Online. Please connect and re-run script`n"
Write-Output "Exception message:", $_.Exception.Message, "`n"
exit 2 # Terminate script
}
$result += $currentoutput # Build total results array
++ $count # Increment page count
} until ($currentoutput.count -eq 0) # Until there are no more logs in range to get
$result | Export-Csv -NoTypeInformation -Path $outputFileUAL -Encoding $Encoding -Append
Write-Output "Results have been written to $outputFile & $outputFileUAL"
}
} elseif ($UserIds -match ",") {
$UserIds.Split(",") | ForEach-Object {
$date = Get-Date -Format "yyyyMMddHHmmss"
$user = $_
$outputFile = "$OutputPath\$DomainName\mailboxAuditLog_$($user)_going_back_$($DaysAgo)_days_from_$($date).csv"
$outputFileUAL = "$OutputPath\$DomainName\mailboxAuditLogUAL_$($user)_going_back_$($DaysAgo)_days_from_$($date).csv"
Write-Output "Collecting the MailboxAuditLog for $user"
Write-Output "Search-MailboxAuditlog -Identity $user -LogonTypes Delegate,Admin,Owner -StartDate $StartDate -EndDate $EndDate -ShowDetails -ResultSize 250000"
$result = Search-MailboxAuditlog -Identity $user -LogonTypes Delegate, Admin, Owner -StartDate $StartDate -EndDate $EndDate -ShowDetails -resultsize 250000
$result | Export-Csv -NoTypeInformation -Path $outputFile -Encoding $Encoding -Append
$sesid = Get-Random # Get random session number
Write-Output "Search-UnifiedAuditLog -RecordType ExchangeItem -UserIds $user -StartDate $StartDate -EndDate $EndDate -SessionId $sesid -SessionCommand ReturnLargeSet -ResultSize $resultSize"
$count = 1
do {
Write-Output "Getting unified audit logs page $count - Please wait"
try {
$currentOutput = Search-UnifiedAuditLog -RecordType ExchangeItem -UserIds $user -StartDate $StartDate -EndDate $EndDate -SessionId $sesid -SessionCommand ReturnLargeSet -ResultSize $resultSize
} catch {
Write-Output "`n[002] - Search Unified Log error. Typically not connected to Exchange Online. Please connect and re-run script`n"
Write-Output "Exception message:", $_.Exception.Message, "`n"
exit 2 # Terminate script
}
$result += $currentoutput # Build total results array
++ $count # Increment page count
} until ($currentoutput.count -eq 0) # Until there are no more logs in range to get
$result | Export-Csv -NoTypeInformation -Path $outputFileUAL -Encoding $Encoding -Append
Write-Output "Results have been written to $outputFile & $outputFileUAL"
}
} else {
$outputFile = "$OutputPath\$DomainName\mailboxAuditLog_$($UserIds)_going_back_$($DaysAgo)_days_from_$($date).csv"
$outputFileUAL = "$OutputPath\$DomainName\mailboxAuditLogUAL_$($UserIds)_going_back_$($DaysAgo)_days_from_$($date).csv"
Write-Output "Collecting the MailboxAuditLog for $UserIds"
Write-Output "Search-MailboxAuditlog -Identity $UserIds -LogonTypes Delegate,Admin,Owner -StartDate $StartDate -EndDate $EndDate -ShowDetails -ResultSize 250000"
$result = Search-MailboxAuditlog -Identity $UserIds -LogonTypes Delegate, Admin, Owner -StartDate $StartDate -EndDate $EndDate -ShowDetails -resultsize 250000
$result | Export-Csv -NoTypeInformation -Path $outputFile -Encoding $Encoding -Append
$sesid = Get-Random # Get random session number
Write-Output "Search-UnifiedAuditLog -RecordType ExchangeItem -UserIds $UserIds -StartDate $StartDate -EndDate $EndDate -SessionId $sesid -SessionCommand ReturnLargeSet -ResultSize $resultSize"
$count = 1
do {
Write-Output "Getting unified audit logs page $count - Please wait"
try {
$currentOutput = Search-UnifiedAuditLog -RecordType ExchangeItem -UserIds $UserIds -StartDate $StartDate -EndDate $EndDate -SessionId $sesid -SessionCommand ReturnLargeSet -ResultSize $resultSize
} catch {
Write-Output "`n[002] - Search Unified Log error. Typically not connected to Exchange Online. Please connect and re-run script`n"
Write-Output "Exception message:", $_.Exception.Message, "`n"
exit 2 # Terminate script
}
$result += $currentoutput # Build total results array
++ $count # Increment page count
} until ($currentoutput.count -eq 0) # Until there are no more logs in range to get
$result | Export-Csv -NoTypeInformation -Path $outputFileUAL -Encoding $Encoding -Append
Write-Output "Results have been written to $outputFile & $outputFileUAL"
}
# * Check mailbox audit settings:
# Get-OrganizationConfig | Format-List AuditDisabled
# Get-MailboxAuditBypassAssociation | Select-Object Name, AuditByPassEnabled | Where-Object -Property AuditBypassEnabled -eq $True | FT
# Get-Mailbox -ResultSize Unlimited | Where-Object { $_.AuditEnabled -eq "$true" } | Select-Object DisplayName, Alias, AuditEnabled, DefaultAuditSet, AuditLogAgeLimit, AuditOwner, AuditDelegate, AuditAdmin | Export-CSV MailboxAuditSettings.csv -NoTypeInformation -Encoding $encoding
# Get-Mailbox -Identity "MailboxIdentity" | Select-Object DisplayName, Alias, AuditEnabled, DefaultAuditSet, AuditLogAgeLimit, AuditOwner, AuditDelegate, AuditAdmin
# Get-Mailbox -Identity "MailboxIdentity" | Select-Object -ExpandProperty AuditOwner
# Get-Mailbox -Identity "MailboxIdentity" | Select-Object -ExpandProperty AuditDelegate
# Get-Mailbox -Identity "MailboxIdentity" | Select-Object -ExpandProperty AuditAdmin
# Get-Mailbox -Identity "MailboxIdentity" | Format-List
# Get-MailboxFolderStatistics -Identity "MailboxIdentity" | Where-Object {$_.FolderType -eq 'Audits'} | Format-Table Identity, ItemsInFolder, FolderSize –auto
# * Restore default settings:
# Set-OrganizationConfig -AuditDisabled $false
# Set-Mailbox -Identity "MailboxIdentity" -DefaultAuditSet Admin,Delegate,Owner
# * Enable auditing of all possible actions:
# Set-Mailbox "MailboxIdentity" -AuditOwner "Create, SoftDelete, HardDelete, Update, Move, MoveToDeletedItems, MailboxLogin, UpdateFolderPermissions"
# Set-Mailbox "MailboxIdentity" -AuditDelegate "Create, FolderBind, SendAs, SendOnBehalf, SoftDelete, HardDelete, Update, Move, MoveToDeletedItems, UpdateFolderPermissions"
# Set-Mailbox "MailboxIdentity" -AuditAdmin "Create, FolderBind, MessageBind, SendAs, SendOnBehalf, SoftDelete, HardDelete, Update, Move, Copy, MoveToDeletedItems, UpdateFolderPermissions"
Write-Output "`nDone! Check output path for results."
Invoke-Item "$OutputPath\$DomainName"
exit