User Profile
Francisco_Caldito
Copper Contributor
Joined Aug 10, 2020
User Widgets
Recent Discussions
Audit who read an email in a Shared Mailbox
Hi! I'm trying to find out which user read an email from a shared mailbox and changed its status from 'Unread' to 'Read'. For this, I am using the following PowerShell command: Search-MailboxAuditLog -Identity <shared mailbox> -StartDate "2024-09-02T15:00:00" -EndDate "2024-09-05T11:00:00" -ShowDetails I get results (Create, SendAs, SoftDelete...), all of them of the type 'LogonType=Delegate', but I don't see any event related to reading the email. If I audit a user's mailbox, I see a lot of 'MailItemsAccessed' and 'Update' events, but not when it's a shared mailbox. How can I audit email readings, especially the first one that changes it from 'Unread' to 'Read'? Thank you very much! 🙂Re: Using Purview to audit a shared mailbox
kyazaferr Thanks for your prompt response. 🙂 I answer you point by point: Permissions: I have and admin role wich include the 'View-Only Audit Logs' and 'Audit Logs', so I can access the logs via ExchangeOnline. Do I have to assign myself roles just for Purview? I have added myself to 'Compilance Administrator'... Audit Logging Enabled: It is enabled, because: - Checked via Powershell: Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled Returns 'true' - I have access to audit search form, so Audit Log must be enabled. Using Audit interface: Followed yor instructions: - Selected ALL Exchange Activities using 'Friendly Names selector' - In users, I set the shared mailbox email - Set start and end date, GMT 0 - Didn't fill any other field No results... 😞 Anything I'm doing wrong?Using Purview to audit a shared mailbox
Good morning, I am trying to review the activity that has occurred in a shared mailbox over a specific period. From Exchange Online in PowerShell, I have managed to access data, but in Purview, I am not getting any results. In Exchange Online, in PowerShell, I use the following commands to export the list of events to an Excel file: $auditlogs = Search-MailboxAuditLog -Identity <shared mailbox> -StartDate "2024-09-02T15:00:00" -EndDate "2024-09-04T08:30:00" -ShowDetails $auditLogs | Export-Csv -Path "C:\temp\auditLogs.csv" -NoTypeInformation -Encoding I have entered Purview and tried several methods, but it always returns '0 results' in the queries. Is there something I need to enable? Any special permission or role required to use this service? What should I fill out in the 'Audit' interface of Purview to obtain the same records that I am getting in Exchange Online with the command shown above? Thank you very much 🙂Disable Microsoft Store in Windows 10/11 HOME
How can I DISABLE Microsoft Store in Windows 11 HOME? I can see A LOT of pages telling how to disable it using Local Policies ('Turn Off the Store Application'), but it does not apply to Windows HOME (no Local Policies) In other cases they refer to EDIT the registry KEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsStore I have tried several values (RemoveWindowsStore), with no luck My questions are: Does changing that policy values in registry has any effect in Windows HOME, or are they useles? May be they only work with windows versions that uses Local Security Policies... If THEY WORK, what am I doing wrong? I reboot after changing registry, to ensure the possible values are updated. Assuming I can use the 'change registry' approach Could I BLOCK any new install (both through installer and Microsoft Store) in my Windows HOME by setting this other value?HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer (DisableUserInstalls =1) Could I prevent an user to access to Control Panel and Pc Settings by setting this other value?HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer (NoControlPanel =1) How can I change the USER_CURRENT_USER values of an standard user? To make changes I must run editor through an administrator account credentials, and then the 'current user' is that other account, and I change its values. Well, I think that are enough questions 🙂 Thanks!Windows 11 Home Lock (Kiosk or similar)
Hi everyone! I have a Windows 11 Home, and I need to create a VERY restricted user. I don't want let him install anything. Not only in Program Files (this is easy, as it promps for Admin rights), but also in Local User (AppData) I don't want let him change Windows configuration (desktop, browsers...) I have read about windows native solutions, like settin up an account in Kiosk Mode, AppLocker, WDAC... but none of them apperar to work for Windows Home versions. The last option I want to resort to is to use third party software, but, even in this case, classic applications like DeepFreeze doesn't look like to work in Windows 11. Could you help me to find a solution? Thanks 🙂
