SOLVED

Enable Audit via powershell

%3CLINGO-SUB%20id%3D%22lingo-sub-95127%22%20slang%3D%22en-US%22%3EEnable%20Audit%20via%20powershell%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-95127%22%20slang%3D%22en-US%22%3E%3CP%3Ehave%202000%20users%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E1500%20are%20audit%20enabled%20in%20office%20365%3C%2FP%3E%3CP%3E500%20to%20be%20enabled%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ehow%20to%20do%20this%20by%20powershell%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-95127%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EExchange%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-204692%22%20slang%3D%22en-US%22%3ERe%3A%20Enable%20Audit%20via%20powershell%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-204692%22%20slang%3D%22en-US%22%3E%3CP%3EHow%20many%20mailboxes%20are%20you%20trying%20to%20process%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20initial%20run%20of%20the%20cmdlet%20probably%20updated%20the%20audit%20setting%20for%20quite%20a%20few%20mailboxes%2C%20so%20you%20can%20now%20reduce%20the%20number%20of%20mailboxes%20remaining%20to%20be%20processed.%20This%20code%20only%20processes%20mailboxes%20that%20still%20have%20not%20had%20their%20audit%20setting%20enabled.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EGet-Mailbox%20-RecipientTypeDetails%20UserMailbox%26nbsp%3B%20%7C%20%3F%20%7B%24_.AuditEnabled%20-eq%20%24False%20%7D%20%7C%20Set-Mailbox%20-AuditEnabled%20%24True%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-204595%22%20slang%3D%22en-US%22%3ERe%3A%20Enable%20Audit%20via%20powershell%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-204595%22%20slang%3D%22en-US%22%3E%3CP%3Ewhen%20we%20tried%20to%20enable%20it%20failed%20with%20time%20out%20.%20do%20you%20have%20any%20script%20to%20apply%20retry%20when%20we%20run%20audit%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-95708%22%20slang%3D%22en-US%22%3ERe%3A%20Enable%20Audit%20via%20powershell%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-95708%22%20slang%3D%22en-US%22%3E%3CP%3EYou%20can%20use%20the%20below%20Command%20%3A%3CBR%20%2F%3E%3CBR%20%2F%3ETO%20enable%20auditing%20for%20a%20single%20mailbox%20(in%20this%20example%2C%20belonging%20to%20Steve%20Smith)%2C%20you%20can%20use%20this%20PowerShell%20command%3A%3CBR%20%2F%3E%3CBR%20%2F%3ESet-Mailbox%20-Identity%20%22Steve%20Smith%22%20-AuditEnabled%20%24true.%3CBR%20%2F%3E%3CBR%20%2F%3ETo%20enable%20auditing%20for%20all%20Office%20365%20mailboxes%20in%20your%20organization%2C%20you%20can%20use%20this%20PowerShell%20command%3A%3CBR%20%2F%3E%3CBR%20%2F%3EGet-Mailbox%20-ResultSize%20Unlimited%20-Filter%7BRecipientTypeDetails%20-eq%20%22UserMailbox%22%7D%20%7C%20Set-Mailbox%20-AuditEnabled%24true.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-95508%22%20slang%3D%22en-US%22%3ERe%3A%20Enable%20Audit%20via%20powershell%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-95508%22%20slang%3D%22en-US%22%3E%3CP%3EGet-Mailbox%20-RecipientTypeDetails%20UserMailbox%20-ResultSize%20Unlimited%20%7C%20%3F%20%7B%24_.AuditEnabled%20-eq%20%24False%7D%20%7C%20Set-Mailbox%20-AuditEnabled%20%24True%20-AuditOwner%26nbsp%3BMailboxLogin%2CHardDelete%2CSoftDelete%2CCreate%2CMove%2CMoveToDeletedItems%2CUpdate%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-95462%22%20slang%3D%22en-US%22%3ERe%3A%20Enable%20Audit%20via%20powershell%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-95462%22%20slang%3D%22en-US%22%3E%3CP%3Ethis%20is%20the%20script%20that%20we%20use%20to%20enable%20audit%2C%20is%20there%20a%20way%20we%20can%20just%20target%20enabling%20disabled%20users%20without%20going%20through%20all%20users%20(including%20enabled%20users)%3F%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FP%3E%3CP%3E%3CSTRONG%3EGet-Mailbox%20-ResultSize%20Unlimited%20-Filter%20%7BRecipientTypeDetails%20-eq%20%22UserMailbox%22%7D%20%7C%20Set-Mailbox%20-AuditEnabled%20%24true%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3E%3CSTRONG%3EGet-Mailbox%20-ResultSize%20Unlimited%20-Filter%20%7BRecipientTypeDetails%20-eq%20%22UserMailbox%22%7D%20%7C%20Set-Mailbox%20-AuditOwner%20MailboxLogin%2CHardDelete%2CSoftDelete%2CCreate%2CMove%2CMoveToDeletedItems%2CUpdate%3C%2FSTRONG%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-95159%22%20slang%3D%22en-US%22%3ERe%3A%20Enable%20Audit%20via%20powershell%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-95159%22%20slang%3D%22en-US%22%3E%3CP%3EAlready%20there%20are%20numerous%20PowerShell%20scripts%20are%20available%20for%20this%20need.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECheck%20out%20the%20article%20below%20to%20know%20how%20to%20enable%20Mailbox%20auditing.%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fdn879651.aspx%3Ff%3D255%26amp%3BMSPPError%3D-2147217396%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fdn879651.aspx%3Ff%3D255%26amp%3BMSPPError%3D-2147217396%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-95158%22%20slang%3D%22en-US%22%3ERe%3A%20Enable%20Audit%20via%20powershell%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-95158%22%20slang%3D%22en-US%22%3Eyes%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-95155%22%20slang%3D%22en-US%22%3ERe%3A%20Enable%20Audit%20via%20powershell%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-95155%22%20slang%3D%22en-US%22%3E%3CP%3EIs%20this%20for%20Exchange%20Online%20Mailbox%20auditing%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Super Contributor

have 2000 users

 

1500 are audit enabled in office 365

500 to be enabled

 

how to do this by powershell?

 

Thanks

8 Replies
Highlighted

Is this for Exchange Online Mailbox auditing?

Highlighted
yes
Highlighted
Best Response confirmed by Juan Carlos González Martín (MVP)
Solution

Already there are numerous PowerShell scripts are available for this need.

 

Check out the article below to know how to enable Mailbox auditing.

https://technet.microsoft.com/en-us/library/dn879651.aspx?f=255&MSPPError=-2147217396

Highlighted

this is the script that we use to enable audit, is there a way we can just target enabling disabled users without going through all users (including enabled users)?

Get-Mailbox -ResultSize Unlimited -Filter {RecipientTypeDetails -eq "UserMailbox"} | Set-Mailbox -AuditEnabled $true

Get-Mailbox -ResultSize Unlimited -Filter {RecipientTypeDetails -eq "UserMailbox"} | Set-Mailbox -AuditOwner MailboxLogin,HardDelete,SoftDelete,Create,Move,MoveToDeletedItems,Update

Highlighted

Get-Mailbox -RecipientTypeDetails UserMailbox -ResultSize Unlimited | ? {$_.AuditEnabled -eq $False} | Set-Mailbox -AuditEnabled $True -AuditOwner MailboxLogin,HardDelete,SoftDelete,Create,Move,MoveToDeletedItems,Update

Highlighted

You can use the below Command :

TO enable auditing for a single mailbox (in this example, belonging to Steve Smith), you can use this PowerShell command:

Set-Mailbox -Identity "Steve Smith" -AuditEnabled $true.

To enable auditing for all Office 365 mailboxes in your organization, you can use this PowerShell command:

Get-Mailbox -ResultSize Unlimited -Filter{RecipientTypeDetails -eq "UserMailbox"} | Set-Mailbox -AuditEnabled$true.

Highlighted

when we tried to enable it failed with time out . do you have any script to apply retry when we run audit

Highlighted

How many mailboxes are you trying to process?

 

The initial run of the cmdlet probably updated the audit setting for quite a few mailboxes, so you can now reduce the number of mailboxes remaining to be processed. This code only processes mailboxes that still have not had their audit setting enabled.

 

Get-Mailbox -RecipientTypeDetails UserMailbox  | ? {$_.AuditEnabled -eq $False } | Set-Mailbox -AuditEnabled $True