When someone is missing a DL and we need to verify when it happened and who made the change (modify or delete), this script can help a lot!
It can return up to 5,000 records and data up to 365 days old. 🙂<\/p>\n\n\n\n
<\/p>\n\n\n\n
$Command = @(‚Remove-DistributionGroup‘)<\/p>\n\n\n\n
$results = Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-365) -EndDate (Get-Date).AddDays(1) -Operations $operations -SessionCommand ReturnLargeSet -ResultSize 5000
$data = @()<\/p>\n\n\n\n
foreach ($line in $results ) {
$content = New-Object -TypeName PSObject
$Converteddata = convertfrom-json $line.AuditData
$content| Add-Member -MemberType NoteProperty -Name CreationTime -Value $line.CreationDate
$content | Add-Member -MemberType NoteProperty -Name Operation -Value $Converteddata.Operation
$content | Add-Member -MemberType NoteProperty -Name GroupOjectID -Value $Converteddata.ObjectId
$content| Add-Member -MemberType NoteProperty -Name ResponsibleUser -Value $Converteddata.UserID
$data += $content
}<\/p>\n\n\n\n
$Data | Select CreationTime, Operation, GroupOjectID,ResponsibleUser<\/p>\n","protected":false},"excerpt":{"rendered":"
When someone is missing a DL and we need to verify when it happened and who made the change (modify or delete), this script can help a lot!It can return up to 5,000 records and data up to 365 days … Cel\u00fd p\u0159\u00edsp\u011bvek