Forum Discussion
Issues with Search-UnifiedAuditLog
I have been trying to export user mailbox audit logs using search-unfiedauditlog PS script but it does not export or find any logs related to delete, movetodeleteditems,softdelete or harddelete opera...
Thanks VasilMichev
tried below but not getting desired result. I know I deleted several emails and calendar items but when running below I get only 1 log entry in csv.
Search-UnifiedAuditLog -StartDate "8/1/2024" -EndDate "8/15/2024" -UserIds email address removed for privacy reasons -SessionId "UnifiedAuditLogSearch 05/08/17" -SessionCommand ReturnLargeSet -ResultSize 5000 -RecordType exchangeitemgroup
tried below but not getting desired result. I know I deleted several emails and calendar items but when running below I get only 1 log entry in csv.
Search-UnifiedAuditLog -StartDate "8/1/2024" -EndDate "8/15/2024" -UserIds email address removed for privacy reasons -SessionId "UnifiedAuditLogSearch 05/08/17" -SessionCommand ReturnLargeSet -ResultSize 5000 -RecordType exchangeitemgroup
AND if I run below PS without record type or operations, it works but only pull user login & mailitemasccessed operations. It does not pull any logs related to softdelete, harddelete or any other exchange operations.
Search-UnifiedAuditLog -StartDate "8/1/2024" -EndDate "8/15/2024" -UserIds email address removed for privacy reasons -SessionId "UnifiedAuditLogSearch 05/08/17" -SessionCommand ReturnLargeSet -ResultSize 5000 | export-csv
Search-UnifiedAuditLog -StartDate "8/1/2024" -EndDate "8/15/2024" -UserIds email address removed for privacy reasons -SessionId "UnifiedAuditLogSearch 05/08/17" -SessionCommand ReturnLargeSet -ResultSize 5000 | export-csv