SOLVED

Audit Log on Shared Calendar

New Contributor

Hi All,

 

I was recently asked to figure out who had changed a meeting in a users shared calendar.  I managed to do this through basically date range and the couple of users I knew it could have been.  However I would have loved to be able to narrow it down to a particular calendar.  How do I get the URL of that calendar please?

 

I tried the path 

\\Calendar\\Ad Ed CIV

In the File, Folder or Site without any luck.

 

Any help would be greatly appreciated.

 

Thank you

4 Replies

@Wayne Singh 

 

You can try the powershell cmdlet  Get-MailboxFolder.

 

Run the below command to list all the available folders in a mailbox.

Get-MailboxFolder -Identity admin@contoso.com -Recurse | Select Name, Identity, FolderClass

 

Run the below command to list only the calendar folders (including shared calendar) in a mailbox.

Get-MailboxFolder -Identity admin@contoso.com -Recurse | Where-Object {$_.FolderClass -eq 'IPF.Appointment'} | Select Name, Identity

 

Sample output:

Name             Identity
----             --------
Calendar         admin:\Calendar
Shared Calendar1 admin:\Calendar\Shared Calendar1 

@Wayne Singh 

 

You can use the Powershell cmdlet Get-MailboxFolder.

 

Run the following command to list all folders in a mailbox.

Get-MailboxFolder -Identity admin@contoso.com -Recurse | Select Name, Identity, FolderClass

Run the following command to list only the calendar folders (including Shared Calendar) in a mailbox.

Get-MailboxFolder -Identity admin@contoso.com -Recurse | Where-Object {$_.FolderClass -eq 'IPF.Appointment'} | Select Name, Identity

Sample output

Name             Identity
----             --------
Calendar         admin:\Calendar
Shared Calendar1 admin:\Calendar\Shared Calendar1
best response confirmed by Wayne Singh (New Contributor)
Solution

Get-MailboxFolder only works for your own mailbox, cannot be used to "peek" into other user's mailboxes. Get-MailboxFolderStatistics can get you the actual folder, but the question as I understand it is how to narrow down the Unified audit log search results by said folder. I suppose the answer is to again use PowerShell and the Search-UnifiedAuditLog cmdlet, together with the -FreeText parameter. Something like this:

 

Search-UnifiedAuditLog -StartDate "25 Dec 2020" -EndDate "04 Jan 2021" -Operations "Update" -RecordType ExchangeItem -FreeText "\\Calendar"

This should be perfect. Thank you very much. Have marked as answer :)