Forum Discussion
Audit Log on Shared Calendar
Get-MailboxFolder only works for your own mailbox, cannot be used to "peek" into other user's mailboxes. Get-MailboxFolderStatistics can get you the actual folder, but the question as I understand it is how to narrow down the Unified audit log search results by said folder. I suppose the answer is to again use PowerShell and the Search-UnifiedAuditLog cmdlet, together with the -FreeText parameter. Something like this:
Search-UnifiedAuditLog -StartDate "25 Dec 2020" -EndDate "04 Jan 2021" -Operations "Update" -RecordType ExchangeItem -FreeText "\\Calendar"
You can use the Powershell cmdlet Get-MailboxFolder.
Run the following command to list all folders in a mailbox.
Get-MailboxFolder -Identity admin@contoso.com -Recurse | Select Name, Identity, FolderClass
Run the following command to list only the calendar folders (including Shared Calendar) in a mailbox.
Get-MailboxFolder -Identity admin@contoso.com -Recurse | Where-Object {$_.FolderClass -eq 'IPF.Appointment'} | Select Name, IdentitySample output
Name Identity ---- -------- Calendar admin:\Calendar Shared Calendar1 admin:\Calendar\Shared Calendar1
Get-MailboxFolder only works for your own mailbox, cannot be used to "peek" into other user's mailboxes. Get-MailboxFolderStatistics can get you the actual folder, but the question as I understand it is how to narrow down the Unified audit log search results by said folder. I suppose the answer is to again use PowerShell and the Search-UnifiedAuditLog cmdlet, together with the -FreeText parameter. Something like this:
Search-UnifiedAuditLog -StartDate "25 Dec 2020" -EndDate "04 Jan 2021" -Operations "Update" -RecordType ExchangeItem -FreeText "\\Calendar"
- This should be perfect. Thank you very much. Have marked as answer 🙂
