Issues with Search-UnifiedAuditLog
I have been trying to export user mailbox audit logs using search-unfiedauditlog PS script but it does not export or find any logs related to delete, movetodeleteditems,softdelete or harddelete operations. I tried below and all other options and either it error out or does not pull anything. I am trying with all below operations and only UPDATE & CREATE works.
Search-UnifiedAuditLog -StartDate “08/01/2024” -EndDate “08/15/2024” -UserIds “email address removed for privacy reasons” -RecordType “ExchangeItem” -Operations “SoftDelete”, “HardDelete”, “MoveToDeletedItems” -ResultSize 5000 -SessionCommand ReturnLargeSet -HighCompleteness
OR
Search-UnifiedAuditLog -StartDate “08/01/2024” -EndDate “08/15/2024” -UserIds “email address removed for privacy reasons” -RecordType “ExchangeItem” -Operations “SoftDelete”, “HardDelete”, “MoveToDeletedItems” -ResultSize 5000 -SessionCommand ReturnLargeSet
I also tried the above PS using each individul operations but nothing works.
Does anybody have any clue or fix for this? Appreciate your help.
I have been trying to export user mailbox audit logs using search-unfiedauditlog PS script but it does not export or find any logs related to delete, movetodeleteditems,softdelete or harddelete operations. I tried below and all other options and either it error out or does not pull anything. I am trying with all below operations and only UPDATE & CREATE works. Search-UnifiedAuditLog -StartDate “08/01/2024” -EndDate “08/15/2024” -UserIds “email address removed for privacy reasons” -RecordType “ExchangeItem” -Operations “SoftDelete”, “HardDelete”, “MoveToDeletedItems” -ResultSize 5000 -SessionCommand ReturnLargeSet -HighCompletenessORSearch-UnifiedAuditLog -StartDate “08/01/2024” -EndDate “08/15/2024” -UserIds “email address removed for privacy reasons” -RecordType “ExchangeItem” -Operations “SoftDelete”, “HardDelete”, “MoveToDeletedItems” -ResultSize 5000 -SessionCommand ReturnLargeSet I also tried the above PS using each individul operations but nothing works.Does anybody have any clue or fix for this? Appreciate your help. Read More
