Forum Discussion
Solved
Audit Log on Shared Calendar
Hi All,
I was recently asked to figure out who had changed a meeting in a users shared calendar. I managed to do this through basically date range and the couple of users I knew it could have been. However I would have loved to be able to narrow it down to a particular calendar. How do I get the URL of that calendar please?
I tried the path
\\Calendar\\Ad Ed CIV
In the File, Folder or Site without any luck.
Any help would be greatly appreciated.
Thank you
Get-MailboxFolder only works for your own mailbox, cannot be used to "peek" into other user's mailboxes. Get-MailboxFolderStatistics can get you the actual folder, but the question as I understand it is how to narrow down the Unified audit log search results by said folder. I suppose the answer is to again use PowerShell and the Search-UnifiedAuditLog cmdlet, together with the -FreeText parameter. Something like this:
Search-UnifiedAuditLog -StartDate "25 Dec 2020" -EndDate "04 Jan 2021" -Operations "Update" -RecordType ExchangeItem -FreeText "\\Calendar"
You can use the Powershell cmdlet Get-MailboxFolder.
Run the following command to list all folders in a mailbox.
Get-MailboxFolder -Identity admin@contoso.com -Recurse | Select Name, Identity, FolderClass
Run the following command to list only the calendar folders (including Shared Calendar) in a mailbox.
Get-MailboxFolder -Identity admin@contoso.com -Recurse | Where-Object {$_.FolderClass -eq 'IPF.Appointment'} | Select Name, IdentitySample output
Name Identity ---- -------- Calendar admin:\Calendar Shared Calendar1 admin:\Calendar\Shared Calendar1
Get-MailboxFolder only works for your own mailbox, cannot be used to "peek" into other user's mailboxes. Get-MailboxFolderStatistics can get you the actual folder, but the question as I understand it is how to narrow down the Unified audit log search results by said folder. I suppose the answer is to again use PowerShell and the Search-UnifiedAuditLog cmdlet, together with the -FreeText parameter. Something like this:
Search-UnifiedAuditLog -StartDate "25 Dec 2020" -EndDate "04 Jan 2021" -Operations "Update" -RecordType ExchangeItem -FreeText "\\Calendar"
- This should be perfect. Thank you very much. Have marked as answer 🙂
You can try the powershell cmdlet Get-MailboxFolder.
Run the below command to list all the available folders in a mailbox.
Get-MailboxFolder -Identity admin@contoso.com -Recurse | Select Name, Identity, FolderClass
Run the below command to list only the calendar folders (including shared calendar) in a mailbox.
Get-MailboxFolder -Identity admin@contoso.com -Recurse | Where-Object {$_.FolderClass -eq 'IPF.Appointment'} | Select Name, IdentitySample output:
Name Identity ---- -------- Calendar admin:\Calendar Shared Calendar1 admin:\Calendar\Shared Calendar1
