Hi there,
I try to create a Powershell AuditLog Search which finds me all labeled documents deleted by a specific person.
After a person has been dismissed, the aim is to find the sensitive documents that this person deleted shortly beforehand.
My script has no output at all and in the moment I am clueless what the reason could be. I made it simpler than my acutal question is:
$daysAgo = 30; $startDate = (Get-Date).AddDays(-$daysAgo)
$results = Search-UnifiedAuditLog -StartDate $startDate -EndDate (Get-Date) -RecordType SharePoint -Operations FileDeleted -ResultSize 5000 |
Where-Object {
$_.CreationTime -gt $startDate
} |
Select-Object CreationTime, UserIds, Operations, AuditData
$results | Export-Csv -Path "PATH.csv" -NoTypeInformation
Does anybody see my error? Thanks in advance 🤞
