Forum Discussion
Help with parameter for Search-UnifiedAuditLog
NarasimaPerumal Chandramohan thanks for pointing me in the right direction. I managed to solve it by using SessionID and SessionCommand. All I needed was a while loop that kept running until the variable taking the audit data returned null, and keep appending the export file in every loop run.
MicrosoftMy needs are specifc to SharePoint online. Using the GUI, I am able to get below 5 different reports and I am working on figuring out the correct PowerShell parameters to use and combine all 5 using the append option to get EVERYTHING that happened on a SINGLE site collection into one report.
File and page activities
Folder activities
Sharing and access request activities
Synchronization activities
Site administration activities
Rajiv Chokshi refering to the Technet article that I linked in the end of my answer; You can use the "Operation" parameter to define the specific activities that you are looking for, but I would probably recommend you try querying all of them first and then review and select the ones you care about.
Using the "RecordType" parameter, I see that you can also filter the search to for example include things like:
- SharePointFileOperation
SharePointSharingOperation
The same with the site collection filter. I do not know directly which parameter that works best for this. As you can see you have one called "SiteIds" which could work, but I'm not sure that the ID stays the same for all sites or sub sites of a site collection. Maybe it would be better to use "ObjectIds" which is queried as string and returns the object as a URL. So defining the site collection url + a wildcard characters should hopefully work. Something like:
SiteIds https://contoso.sharepoint.com/sites/sitecollectionname*
Hope this helps!
SiteIds absolutely does work, but as you indicate, the problem is to find the GUID for the site. If you have an audit record for an action performed in the site, you can find it in the "more information" details for the record. You can then do something like:
PS C:\> Search-UnifiedAuditLog -SiteIds acfe74d8-edfb-436d-924b-e018666605ee -StartDate 1-dec-2017 -EndDate 18-apr-2018 | ft creat iondate, userids, operations
I believe the SiteIds parameter does work, you just need to use the Site GUID (which you can obtain from the Audit Log Search in the Security and Compliance Center).
- The SiteIds parameter doesn't work, i tried passing in WebId, Site but i get error
The Site Id search is not yet supported.
+ CategoryInfo : InvalidArgument: (:) [Search-UnifiedAuditLog], NotSupportedException
+ FullyQualifiedErrorId : [Server=VI1P191MB0240,RequestId=800fa919-711b-47ee-9915-699b8684a804,TimeStamp=28/12/2017 11:30:37] [FailureCategory=Cmdlet-NotSupportedException] 518C5EC4,Microsoft.Exchange.Management.SystemConfigurationTasks.Searc
hUnifiedAuditLog
+ PSComputerName : outlook.office365.com - Rajiv Chokshi
Thanks, I will try again using your tips. Appreciate your help.
