SOLVED

Audit Log on Shared Calendar

%3CLINGO-SUB%20id%3D%22lingo-sub-2031394%22%20slang%3D%22en-US%22%3EAudit%20Log%20on%20Shared%20Calendar%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2031394%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20All%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20was%20recently%20asked%20to%20figure%20out%20who%20had%20changed%20a%20meeting%20in%20a%20users%20shared%20calendar.%26nbsp%3B%20I%20managed%20to%20do%20this%20through%20basically%20date%20range%20and%20the%20couple%20of%20users%20I%20knew%20it%20could%20have%20been.%26nbsp%3B%20However%20I%20would%20have%20loved%20to%20be%20able%20to%20narrow%20it%20down%20to%20a%20particular%20calendar.%26nbsp%3B%20How%20do%20I%20get%20the%20URL%20of%20that%20calendar%20please%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20tried%20the%20path%26nbsp%3B%3C%2FP%3E%3CPRE%3E%5C%5CCalendar%5C%5CAd%20Ed%20CIV%3C%2FPRE%3E%3CP%3EIn%20the%20File%2C%20Folder%20or%20Site%20without%20any%20luck.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAny%20help%20would%20be%20greatly%20appreciated.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThank%20you%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2031394%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAdmin%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ECompliance%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2031871%22%20slang%3D%22en-US%22%3ERe%3A%20Audit%20Log%20on%20Shared%20Calendar%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2031871%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F150390%22%20target%3D%22_blank%22%3E%40Wayne%20Singh%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EYou%20can%20use%20the%20Powershell%20cmdlet%26nbsp%3BGet-MailboxFolder.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERun%20the%20following%20command%20to%20list%20all%20folders%20in%20a%20mailbox.%3C%2FP%3E%3CPRE%3EGet-MailboxFolder%20-Identity%20admin%40contoso.com%20-Recurse%20%7C%20Select%20Name%2C%20Identity%2C%20FolderClass%3C%2FPRE%3E%3CP%3ERun%20the%20following%20command%20to%20list%20only%20the%20calendar%20folders%20(including%20Shared%20Calendar)%20in%20a%20mailbox.%3C%2FP%3E%3CPRE%3EGet-MailboxFolder%20-Identity%20admin%40contoso.com%20-Recurse%20%7C%20Where-Object%20%7B%24_.FolderClass%20-eq%20'IPF.Appointment'%7D%20%7C%20Select%20Name%2C%20Identity%3C%2FPRE%3E%3CP%3ESample%20output%3C%2FP%3E%3CPRE%3EName%20%20%20%20%20%20%20%20%20%20%20%20%20Identity%0A----%20%20%20%20%20%20%20%20%20%20%20%20%20--------%0ACalendar%20%20%20%20%20%20%20%20%20admin%3A%5CCalendar%0AShared%20Calendar1%20admin%3A%5CCalendar%5CShared%20Calendar1%3C%2FPRE%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2031963%22%20slang%3D%22en-US%22%3ERe%3A%20Audit%20Log%20on%20Shared%20Calendar%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2031963%22%20slang%3D%22en-US%22%3E%3CP%3EGet-MailboxFolder%20only%20works%20for%20your%20own%20mailbox%2C%20cannot%20be%20used%20to%20%22peek%22%20into%20other%20user's%20mailboxes.%20Get-MailboxFolderStatistics%20can%20get%20you%20the%20actual%20folder%2C%20but%20the%20question%20as%20I%20understand%20it%20is%20how%20to%20narrow%20down%20the%20Unified%20audit%20log%20search%20results%20by%20said%20folder.%20I%20suppose%20the%20answer%20is%20to%20again%20use%20PowerShell%20and%20the%20Search-UnifiedAuditLog%20cmdlet%2C%20together%20with%20the%20-FreeText%20parameter.%20Something%20like%20this%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ESearch-UnifiedAuditLog%20-StartDate%20%2225%20Dec%202020%22%20-EndDate%20%2204%20Jan%202021%22%20-Operations%20%22Update%22%20-RecordType%20ExchangeItem%20-FreeText%20%22%5C%5CCalendar%22%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2031725%22%20slang%3D%22en-US%22%3ERe%3A%20Audit%20Log%20on%20Shared%20Calendar%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2031725%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F150390%22%20target%3D%22_blank%22%3E%40Wayne%20Singh%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EYou%20can%20try%20the%20powershell%20cmdlet%26nbsp%3B%20Get-MailboxFolder.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERun%20the%20below%20command%20to%20list%20all%20the%20available%20folders%20in%20a%20mailbox.%3C%2FP%3E%3CPRE%20class%3D%22lia-code-sample%20language-powershell%22%3E%3CCODE%3EGet-MailboxFolder%20-Identity%20admin%40contoso.com%20-Recurse%20%7C%20Select%20Name%2C%20Identity%2C%20FolderClass%3C%2FCODE%3E%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERun%20the%20below%20command%20to%20list%20only%20the%20calendar%20folders%20(including%20shared%20calendar)%20in%20a%20mailbox.%3C%2FP%3E%3CPRE%20class%3D%22lia-code-sample%20language-applescript%22%3E%3CCODE%3EGet-MailboxFolder%20-Identity%20admin%40contoso.com%20-Recurse%20%7C%20Where-Object%20%7B%24_.FolderClass%20-eq%20'IPF.Appointment'%7D%20%7C%20Select%20Name%2C%20Identity%3C%2FCODE%3E%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESample%20output%3A%3C%2FP%3E%3CPRE%20class%3D%22lia-code-sample%20language-powershell%22%3E%3CCODE%3EName%20%20%20%20%20%20%20%20%20%20%20%20%20Identity%0A----%20%20%20%20%20%20%20%20%20%20%20%20%20--------%0ACalendar%20%20%20%20%20%20%20%20%20admin%3A%5CCalendar%0AShared%20Calendar1%20admin%3A%5CCalendar%5CShared%20Calendar1%3C%2FCODE%3E%3C%2FPRE%3E%3C%2FLINGO-BODY%3E
New Contributor

Hi All,

 

I was recently asked to figure out who had changed a meeting in a users shared calendar.  I managed to do this through basically date range and the couple of users I knew it could have been.  However I would have loved to be able to narrow it down to a particular calendar.  How do I get the URL of that calendar please?

 

I tried the path 

\\Calendar\\Ad Ed CIV

In the File, Folder or Site without any luck.

 

Any help would be greatly appreciated.

 

Thank you

4 Replies

@Wayne Singh 

 

You can try the powershell cmdlet  Get-MailboxFolder.

 

Run the below command to list all the available folders in a mailbox.

Get-MailboxFolder -Identity admin@contoso.com -Recurse | Select Name, Identity, FolderClass

 

Run the below command to list only the calendar folders (including shared calendar) in a mailbox.

Get-MailboxFolder -Identity admin@contoso.com -Recurse | Where-Object {$_.FolderClass -eq 'IPF.Appointment'} | Select Name, Identity

 

Sample output:

Name             Identity
----             --------
Calendar         admin:\Calendar
Shared Calendar1 admin:\Calendar\Shared Calendar1 

@Wayne Singh 

 

You can use the Powershell cmdlet Get-MailboxFolder.

 

Run the following command to list all folders in a mailbox.

Get-MailboxFolder -Identity admin@contoso.com -Recurse | Select Name, Identity, FolderClass

Run the following command to list only the calendar folders (including Shared Calendar) in a mailbox.

Get-MailboxFolder -Identity admin@contoso.com -Recurse | Where-Object {$_.FolderClass -eq 'IPF.Appointment'} | Select Name, Identity

Sample output

Name             Identity
----             --------
Calendar         admin:\Calendar
Shared Calendar1 admin:\Calendar\Shared Calendar1
best response confirmed by Wayne Singh (New Contributor)
Solution

Get-MailboxFolder only works for your own mailbox, cannot be used to "peek" into other user's mailboxes. Get-MailboxFolderStatistics can get you the actual folder, but the question as I understand it is how to narrow down the Unified audit log search results by said folder. I suppose the answer is to again use PowerShell and the Search-UnifiedAuditLog cmdlet, together with the -FreeText parameter. Something like this:

 

Search-UnifiedAuditLog -StartDate "25 Dec 2020" -EndDate "04 Jan 2021" -Operations "Update" -RecordType ExchangeItem -FreeText "\\Calendar"

This should be perfect. Thank you very much. Have marked as answer :)