Forum Discussion

endakelly's avatar
endakelly
Brass Contributor
May 19, 2020

Office operations missing username

We get the odd alert through for rare office operations that doesn't seem to have any information on the user or mailbox the operation was performed on.   I suspect this may be because the user or ...
endakelly's avatar
endakelly
Brass Contributor
Jun 10, 2020

I've managed to figure this out. A fresh set of eyes will do you good for any problem. :stareyes:

 

It's the samaccountname it seems which you can find via Exchange powershell.

 

 

Get-Mailbox -Identity username@domain.com | fl

 

 

Running this command to search by SamAccountName will output the user. This didn't work for me initially because I was using double quotes but you need to use single quotes to stop the dollar sign from being expanded into a variable https://stackoverflow.com/questions/17452401/escaping-dollar-signs-in-powershell-path-is-not-working

 

get-mailbox -resultsize unlimited | where-object {$_.SamAccountName -eq '$1ABCD0-EFGH23456'}

 

 

I'm thinking now there could be a way to leverage some of the steps in this blog article to automatically link this attribute to a username via Exchange 365. 

https://techcommunity.microsoft.com/t5/azure-sentinel/enriching-azure-sentinel-with-azure-ad-information/ba-p/1288805

 

What you will see as well if you expand the Office Activity logs is that there will often be a similar event logged just before or just after which will have the actual username in it anyway.

Resources