Audit Log on Shared Calendar

Hi All, I was recently asked to figure out who had changed a meeting in a users shared calendar. I managed to do this through basically date range and the couple of users I knew it could have be...

admin

compliance

office 365

VasilMichev
Jan 05, 2021
Get-MailboxFolder only works for your own mailbox, cannot be used to "peek" into other user's mailboxes. Get-MailboxFolderStatistics can get you the actual folder, but the question as I understand it is how to narrow down the Unified audit log search results by said folder. I suppose the answer is to again use PowerShell and the Search-UnifiedAuditLog cmdlet, together with the -FreeText parameter. Something like this:

Search-UnifiedAuditLog -StartDate "25 Dec 2020" -EndDate "04 Jan 2021" -Operations "Update" -RecordType ExchangeItem -FreeText "\\Calendar"

VasilMichev

MVP

Jan 05, 2021

Get-MailboxFolder only works for your own mailbox, cannot be used to "peek" into other user's mailboxes. Get-MailboxFolderStatistics can get you the actual folder, but the question as I understand it is how to narrow down the Unified audit log search results by said folder. I suppose the answer is to again use PowerShell and the Search-UnifiedAuditLog cmdlet, together with the -FreeText parameter. Something like this:

Search-UnifiedAuditLog -StartDate "25 Dec 2020" -EndDate "04 Jan 2021" -Operations "Update" -RecordType ExchangeItem -FreeText "\\Calendar"

Wayne Singh

Brass Contributor

Jan 05, 2021

This should be perfect. Thank you very much. Have marked as answer 🙂

Forum Discussion

Audit Log on Shared Calendar

Resources