Share via

query on audit logs

Roger Roger 6,041 Reputation points
2024-10-02T12:01:00.45+00:00

Hi All,

I have a distribution list (DL), and some members were removed while others were added. I would like to check the audit logs to see who made these changes to the DL. I am encountering an error when using the syntax below. Please guide me. Let's say my DL is [email protected].

$date=((get-date).AddDays(-30)).ToShortDateString()
$Today=(get-date).ToShortDateString()
Search-UnifiedAuditLog -identity [email protected] -Cmdlets Add-DistributionGroupMember,Remove-DistributionGroupMember,update-DistributionGroupMember -ObjectIds name -ShowDetails -StartDate $date -EndDate $Today | Export-CSV C:\temp\output.csv –NoTypeInformation -Encoding UTF8
Microsoft Exchange Online
Exchange Server
Exchange Server
A family of Microsoft client/server messaging and collaboration software.
1,289 questions
Microsoft Exchange Online Management
Microsoft Exchange Online Management
Microsoft Exchange Online: A Microsoft email and calendaring hosted service.Management: The act or process of organizing, handling, directing or controlling something.
4,515 questions
Exchange Server Management
Exchange Server Management
Exchange Server: A family of Microsoft client/server messaging and collaboration software.Management: The act or process of organizing, handling, directing or controlling something.
7,625 questions
Microsoft Exchange Hybrid Management
Microsoft Exchange Hybrid Management
Microsoft Exchange: Microsoft messaging and collaboration software.Hybrid Management: Organizing, handling, directing or controlling hybrid deployments.
2,093 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Mike Hu-MSFT 3,675 Reputation points Microsoft Vendor
    2024-10-03T06:25:38.1066667+00:00

    Hi,

    Welcome to Microsoft Q&A community!

    Here’s a revised version of your PowerShell script:

    $date = (Get-Date).AddDays(-30)
$Today = Get-Date
Search-UnifiedAuditLog -StartDate $date -EndDate $Today -RecordType ExchangeAdmin -Operations Add-DistributionGroupMember,Remove-DistributionGroupMember,Update-DistributionGroupMember -ObjectIds [email protected] -ResultSize 5000 | Export-CSV C:\temp\output.csv -NoTypeInformation -Encoding UTF8

    Key Changes:

    Date Variables: Use Get-Date directly without converting to a string.

    RecordType: Specify ExchangeAdmin to focus on administrative changes.

    Operations: Ensure the cmdlets are correctly specified.

    ResultSize: Increase the result size to ensure you capture all relevant logs.

    Any updates please be free to contact us!

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.