Enable Audit via powershell

[Marvin Oco]

have 2000 users

1500 are audit enabled in office 365

500 to be enabled

how to do this by powershell?

Thanks

[#2]

Is this for Exchange Online Mailbox auditing?

[#3]

yes

[#4 · Accepted solution]

Already there are numerous PowerShell scripts are available for this need.

Check out the article below to know how to enable Mailbox auditing.

https://technet.microsoft.com/en-us/library/dn879651.aspx?f=255&MSPPError=-2147217396

[#5]

this is the script that we use to enable audit, is there a way we can just target enabling disabled users without going through all users (including enabled users)?

Get-Mailbox -ResultSize Unlimited -Filter {RecipientTypeDetails -eq "UserMailbox"} | Set-Mailbox -AuditEnabled $true

Get-Mailbox -ResultSize Unlimited -Filter {RecipientTypeDetails -eq "UserMailbox"} | Set-Mailbox -AuditOwner MailboxLogin,HardDelete,SoftDelete,Create,Move,MoveToDeletedItems,Update

[#6]

Get-Mailbox -RecipientTypeDetails UserMailbox -ResultSize Unlimited | ? {$_.AuditEnabled -eq $False} | Set-Mailbox -AuditEnabled $True -AuditOwner MailboxLogin,HardDelete,SoftDelete,Create,Move,MoveToDeletedItems,Update

[#7]

You can use the below Command :

TO enable auditing for a single mailbox (in this example, belonging to Steve Smith), you can use this PowerShell command:

Set-Mailbox -Identity "Steve Smith" -AuditEnabled $true.

To enable auditing for all Office 365 mailboxes in your organization, you can use this PowerShell command:

Get-Mailbox -ResultSize Unlimited -Filter{RecipientTypeDetails -eq "UserMailbox"} | Set-Mailbox -AuditEnabled$true.

[#8]

when we tried to enable it failed with time out . do you have any script to apply retry when we run audit

[#9]

How many mailboxes are you trying to process?

The initial run of the cmdlet probably updated the audit setting for quite a few mailboxes, so you can now reduce the number of mailboxes remaining to be processed. This code only processes mailboxes that still have not had their audit setting enabled.

Get-Mailbox -RecipientTypeDetails UserMailbox  | ? {$_.AuditEnabled -eq $False } | Set-Mailbox -AuditEnabled $True