Forum Discussion
Solved
Audit Log on Shared Calendar
Hi All, I was recently asked to figure out who had changed a meeting in a users shared calendar. I managed to do this through basically date range and the couple of users I knew it could have be...
Get-MailboxFolder only works for your own mailbox, cannot be used to "peek" into other user's mailboxes. Get-MailboxFolderStatistics can get you the actual folder, but the question as I understand it is how to narrow down the Unified audit log search results by said folder. I suppose the answer is to again use PowerShell and the Search-UnifiedAuditLog cmdlet, together with the -FreeText parameter. Something like this:
Search-UnifiedAuditLog -StartDate "25 Dec 2020" -EndDate "04 Jan 2021" -Operations "Update" -RecordType ExchangeItem -FreeText "\\Calendar"
You can try the powershell cmdlet Get-MailboxFolder.
Run the below command to list all the available folders in a mailbox.
Get-MailboxFolder -Identity admin@contoso.com -Recurse | Select Name, Identity, FolderClass
Run the below command to list only the calendar folders (including shared calendar) in a mailbox.
Get-MailboxFolder -Identity admin@contoso.com -Recurse | Where-Object {$_.FolderClass -eq 'IPF.Appointment'} | Select Name, Identity
Sample output:
Name Identity ---- -------- Calendar admin:\Calendar Shared Calendar1 admin:\Calendar\Shared Calendar1