March 2014 ~ eyaltest11

Monday, March 24, 2014

Article 12 |Links and information

Proin diam tortor, ornare vel semper at, lacinia at nulla. Cum sociis natoque penatibus et magnis dis parturient montes, nascetur ridiculus mus. Pellentesque scelerisque ligula non enim placerat facilisis. Nullam suscipit enim magna, et molestie enim. Ut porta viverra tincidunt. Suspendisse potenti. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos himenaeos. Phasellus facilisis ipsum eu risus ultricies tincidunt. Praesent non urna libero, et varius massa. Donec dignissim convallis tristique. Nullam a neque nec turpis suscipit eleifend. Cum sociis natoque penatibus et magnis dis parturient montes, nascetur ridiculus mus. Duis posuere mollis cursus. Suspendisse potenti. Morbi facilisis adipiscing viverra. Sed malesuada vehicula arcu non bibendum. Nam nec massa quis ante mattis pharetra eget id est. Nam quis urna sed nunc sollicitudin aliquet sit amet dignissim felis. Etiam sodales egestas tellus eget faucibus. Vestibulum ante ipsum primis in faucibus orci luctus et ultrices posuere cubilia Curae; Nulla nunc nisi, tristique eget ullamcorper eget, vehicula sit amet tellus. Suspendisse commodo malesuada mi a luctus. Vestibulum nec erat tortor, dictum semper magna. In eget tempus nisl. Nullam dapibus, purus et tempus blandit, velit leo pretium neque, sed aliquam tortor nisi sit amet eros. Sed sit amet placerat turpis. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos himenaeos. In interdum orci vitae magna auctor posuere. Vivamus magna nunc, tincidunt eget tempus in, convallis vitae massa. Nulla facilisi. Lorem ipsum dolor sit amet, consectetur adipiscing elit. Curabitur ipsum purus, sagittis at faucibus in, mattis ut sem. Vestibulum sit amet purus sed odio pellentesque fermentum. Etiam et erat vitae justo adipiscing posuere. Pellentesque id libero nisl, hendrerit volutpat nunc. Aenean lacinia dui ut lectus luctus porta. Sed volutpat, lorem eget luctus fermentum, mi mi faucibus massa, tempor consectetur justo enim vitae sem. Sed porta ipsum sed ipsum auctor vitae luctus felis porttitor. Nunc mattis enim sed diam dictum mattis a non risus. Sed eget facilisis lorem. Proin suscipit adipiscing mollis. Nulla ac libero nec augue condimentum cursus vel et eros. Integer tristique rutrum nulla, in tincidunt risus sodales et. Suspendisse lacinia hendrerit blandit. Suspendisse accumsan nisl eget erat pretium id viverra neque condimentum. Ut lobortis, magna et vestibulum porta, mauris urna lacinia tellus, nec tristique nisi quam vel sapien. Phasellus eros felis, venenatis nec accumsan sed, auctor nec nunc. Nunc nulla eros, scelerisque et venenatis et, mattis ac diam. Lorem ipsum dolor sit amet, consectetur adipiscing elit. Vestibulum malesuada, nibh quis egestas pellentesque, dui neque sagittis nisl, eget malesuada nunc felis sed augue. Aenean tempor nibh sed diam elementum sollicitudin quis in metus. Praesent tincidunt, velit id laoreet dictum, ante elit molestie nunc, ut dictum nulla lectus fringilla felis. Ut molestie, justo at suscipit auctor, dui felis imperdiet eros, eget tempor libero nisi a felis. Donec felis arcu, lobortis vitae accumsan non, dapibus sed elit. Duis nec justo diam. Aliquam erat volutpat. Etiam mi diam, ornare eu faucibus nec, volutpat a quam. Phasellus sed risus et nisl accumsan ultricies vel quis magna. Praesent metus mauris, egestas id bibendum quis, pellentesque id dui. Pellentesque habitant morbi tristique senectus et netus et malesuada fames ac turpis egestas. Suspendisse tincidunt quam sit amet leo laoreet eget ornare est sagittis. Pellentesque habitant morbi tristique senectus et netus et malesuada fames ac turpis egestas. Quisque at tellus quis tortor ornare hendrerit sit amet quis sem. In eu congue diam. Proin diam tortor, ornare vel semper at, lacinia at nulla. Cum sociis natoque penatibus et magnis dis parturient montes, nascetur ridiculus mus. Pellentesque scelerisque ligula non enim placerat facilisis. Nullam suscipit enim magna, et molestie enim. Ut porta viverra tincidunt. Suspendisse potenti. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos himenaeos. Phasellus facilisis ipsum eu risus ultricies tincidunt. Praesent non urna libero, et varius massa. Donec dignissim convallis tristique. Nullam a neque nec turpis suscipit eleifend. Cum sociis natoque penatibus et magnis dis parturient montes, nascetur ridiculus mus. Duis posuere mollis cursus. Suspendisse potenti. Morbi facilisis adipiscing viverra. Sed malesuada vehicula arcu non bibendum. Nam nec massa quis ante mattis pharetra eget id est. Nam quis urna sed nunc sollicitudin aliquet sit amet dignissim felis. Etiam sodales egestas tellus eget faucibus. Vestibulum ante ipsum primis in faucibus orci luctus et ultrices posuere cubilia Curae; Nulla nunc nisi, tristique eget ullamcorper eget, vehicula sit amet tellus. Suspendisse commodo malesuada mi a luctus. Vestibulum nec erat tortor, dictum semper magna. In eget tempus nisl. Nullam dapibus, purus et tempus blandit, velit leo pretium neque, sed aliquam tortor nisi sit amet eros. Sed sit amet placerat turpis. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos himenaeos. In interdum orci vitae magna auctor posuere. Vivamus magna nunc, tincidunt eget tempus in, convallis vitae massa. Nulla facilisi. Lorem ipsum dolor sit amet, consectetur adipiscing elit. Curabitur ipsum purus, sagittis at faucibus in, mattis ut sem. Vestibulum sit amet purus sed odio pellentesque fermentum.

PLEASE SHARE

Test 005

PLEASE SHARE

Before we start to review all the elements that relate to the user desktop it’s important to emphasize that the subject of “desktop preparation” have a huge impact on the final target that could be described as: successfully, migration to Office 365. You could have a very well plan that involve all the required settings and configuration required for the “server side” but the “meeting point” of the users with Office 365, is their Desktops. If the user desktop will not be prepared correctly, our end users will experience many difficulties and problems expressed as: authentication problem, in ability to access their cloud mailbox, problem of using SharePoint Online web interface and so on. Software updates The subject of software update is very important steps that need to be completed before the migration to Office 365. The formal description about the "minimum requirement" for the operation system and for the office version as the name imply is just the minimum.

PLEASE SHARE

In this article we will review a very usefully Microsoft troubleshooting tool named: Office Configuration Analyzer Tool (OffCAT). The OffCAT can provide a big help in the process of troubleshooting Microsoft office application but in this article, I would like to focus on the “outlook troubleshooting process” because in an office 365 environment, the outlook is our main connection to the cloud mailbox.

Table of Content

How does the OffCAT tool work?
Download and install the OffCAT tool
How to start an OffCAT scan
How to read\use the OffCAT scan results
How to download Microsoft Hotfix
Reading and exporting the OffCAT report file

Before we begin

The Office Configuration Analyzer Tool (OffCAT) is a very useful troubleshooting tools that can help us to detect and solve issues related to office installations and particularly outlook. Regarding issues\problems that related to outlook, there are many symptoms such as: Outlook slow performance, mail that doesn’t send with restarting outlook, re prompt of authentication windows, calendar issues and so on.

When we try to start a troubleshooting process the main challenge is the element or to pinpoint the “factor” that is the case for the problem. For example, the “factor” that could cause outlook problems could be: 3 party outlook add-in\plugins, lack of software updates, corruption of outlook cache file (OST file), antivirus applications, and network problem and so on.
The good news is that we can use the OffCAT tool as a key tool for finding the case (and the solution) in the process of troubleshooting outlook problems.

How does the OffCAT tool work?

The concept of the OffCAT tool is based on an interesting idea: the Microsoft office support team create an “office troubleshooting database” that include a documentation and description of

Problems and causes related to Microsoft office.
Solution and recommendation for solving or dealing with this issues.

When we use the “scan” option of the OffCAT tool, OffCAT scan the local workstation and collect information about the “desktop environment” and the selected office component (outlook in our example) that includes: OS settings, registry settings, software updates, outlook database, outlook settings and so on.

Using the information that was collected from the scan, the OffCAT tool access the “office troubleshooting database” and try to allocate “well known issues” or “best practice” solution related to the information that was collected from the local user desktop.

Note - the OffCAT tool was created for improving the troubleshooting process related to all of the Microsoft office components such as: Word, Excel, PowerPoint, outlook and so on. In this article we will focus on the “outlook troubleshooting process”

Although the use of OffCAT tool is quite easy and straight forward, I would like to emphasize to workflow processes in an “outlook troubleshooting process”

Step 1 - Download and install the OffCAT tool

We need to install the OffCAT tool on each of the user desktops that that report about outlook problems.

Step 2 - Scan and fix

The “OffCAT Scan process” will collect information and based on the “unique information” that was collected from the user desktop, provide a comprehensive report that include the information about the local desktop\outlook settings + a suggestion for an optional solutions. Most of the time, the “solution suggestions” include a link to a technical article with details information or link to required software fix that could solve the outlook issue.

Step 3 - Save and send OffCAT XML report

In case that the suggested solution helps us to solve the outlook problem, then “everybody is happy”. If not, we can send all of the information that was collected by the OffCAT tool to the office 365 support team for further examination and Analysis ( we will review how to use the option of: OffCAT XML report in the section Reading and exporting the OffCAT report file )

Download and install the OffCAT tool

The download and the install process of Office Configuration Analyzer Tool (OffCAT) are very simple.

Step 1 - Download Office Configuration Analyzer Tool

You can download OffCAT by using the following link: Office Configuration Analyzer Tool (OffCAT) ( http://www.microsoft.com/en-us/download/details.aspx?id=36852)

Click on the Download option

In the next window choose the option: OffCAT.MSI

Step 2 - install the Office Configuration Analyzer Tool

On the Welcome to the Microsoft office configuration analyzer tool setup wizard click on the Next button

On the license agreement window choose the option: I agree

On the Select Installation Folder window, Leave the default setting and click on the Next button

On the confirm installation windows, click on the Next button

On the installation complete windows, click on the close button

How to start an OffCAT scan

The “OffCAT scan process” collect information about the local desktop (OS environment setting and office product such as: outlook settings) and in the last step, present the "Findings" that include recommendations and solution for existing problems or for preventing future problems.

After the installation is completed, you can find the icon of the OffCAT 1.0 on the start menu.

When we turn on the OffCAT, the best practice is to use the option of: “check for update”. As mention before, the OffCAT uses an “office will know issue database” that include a description of this issues and suggested solutions. This database is updated frequently and this is the reason for using the “update” option.

Click on the option: check for updates now

Click on the option: Start a scan

In the following screenshot we can see that the OffCAT is designed to help us with the troubleshooting process of all office products. In this article we will focus on the “outlook scan” option.

Under the section: select an office application to scan, choose the option: outlook

The OffCAT can execute two types of outlook scans: Full scan, that require to “turn on” outlook and offline scan. The preferred option is the Fill scan because, using this option we can get more detailed information about the specific outlook mail profile (outlook can include more than one mail profile) and additionally we get detected issues that appear only when the outlook mail client is turned-on.

In the following screenshot we can see that the OffCAT recognize that the outlook is not running.
(You can see that the recommendation is: “please start outlook and click here when done, or choose Offline scan in the Task drop-down list).

In the following screenshot we can see the OffCAT windows when outlook is running. We will need to provide a name to the scan. The OffCAT can save all of the scan results that was executed, and we can ask the see the result of a former scans.

In the Enter the scan label text box enter the name of the scan
In the Task section, the default scan is: Full Scan
Click on the: Start scanning option

The scan process could take a couple of minutes. When the scan process end we can choose to see the scan result (and the offered solution) by choosing the option: View a report of this configuration scan or save the result of the scan result by choosing the option: Export this scan.

In the following screenshot, we can see all of the different “sections” that was examined such as: Add-ins (Microsoft and third party) and third-party modules, Application event log and many more (The scan process includes 21 “sections”).

Because of the large number of “sections” that are scanned, we cannot present all of the sections in a single screenshot. For this reason, I attached an additional screenshot that include the rest of the “sections”:

How to read\use the OffCAT scan results

In this part we review the result of the scan. The screen looks a little bit “crowded”, so let examine the different parts:

The upper menu (Number 1) enables us to choose the “style” of the report. The default option is: List reports and we can choose the option of: Tree reports. An additional option that we can use is the: other report, which enable us to see result of a former report (scans).

The second level menu (Number 2) is a “pre defend view” (filter) that enable us to examine specific part of the information that included in the full scan report. The default view is: All issues and we can choose another type of view such as: Critical issues or Informational Items.

The report results includes many important details about existing issues and, we can spend a long time trying to provide detailed information about each of the “finding” but instead, I would like to focus on the subject of: office software updates.

From my experience, in a troubleshooting process, we should always start with the ”obvious thing” before we start to use the “heavy artillery”. The meaning is the most of the times we ignore the issue of: Required software updates but many time, installing this software update will solve a considerable part of the problem that we are dealing with.

In the following screenshot we can see that the scan result presented under the “All issues (8 items) section. One of the most important sections is: Office Updates: Installed Updates.

We can see that the OffCAT recognize that there are important outlook software updates that are missing.

When we click on one of the “information row”, we can see detailed information about the specific software update and a link that will lead us directly to the “download page”.

In the following screenshot we can see another example for an “error” that was detected by the OffCAT. In our example we can see that there is a problem with the OAB (offline address book) that was not downloaded to the local workstation.

How to Download Microsoft Hotfix

In the section I would like to quickly review the subject of: Hotfix. One of the major advantages of the OffCAT scan is the ability to recognize problems that could be solved or fix by installing software updates classified as: Hotfix. This kind of software updates doesn't included by default in the “software update database”.

Microsoft software updates that described as: “Hotfix” are a little bit different from “standard software updates”. Hotfix updates, as the name implies, are “hot” software updates (temporary) that there primary function is to fix some issue\problem, until a “formal update” will be published. I discuss the issue of the “Hotfix” because of two reasons:

Hotfixes and Windows update
From my experience, software updates that classified as: Hotfix are not downloaded (and installed) automatically by windows update component (or WSUS server).
Manually download and install procedure
The process of: download and install software updates that classified as: Hotfix is different from a “standard software updates” because to be able to download an Hotfix, we will need to provide information about our email address and identification code. Only after the successful completion of this process, we will get a “replay mail” that include the link for downloading the required software update (the Hotfix).

In the following section we review the procedure of downloading Hotfix.

Step 1 - Access the download page

In our scenario, a missing Hotfix was discovered by the OffCAT scan. When we click on the link, we will get to a page such as the following page:

Click on the: Hotfix download available link

Step 2 - Request for the Hotfix

In the following screenshot we can see that there are two versions for the Hotfix: 32 bit version and 64 bit version. When we dealing with Hotfixes that related to office, 99% of the time, the 32 bit version is the version that we will need. Despite of the fact that most of the modern OS are 64 bit versions, most of the Microsoft office versions are 32 bit.

Choose the required version of the Hotfix. In our example we choose the 32 bit version.
Enter your email address
Type the verification code that appear on the screen and click on the option: request hotfix

The final screen is an: Hotfix confirmation that displays the email address to which the download link will be sent

Step 3 - Download the Hotfix

In the following screenshot we can see an example to a mail that was sent that include a download link for the hotfix.

Reading and exporting the OffCAT report file

In the last section we will review the process of working with the OffCAT scan. Each time we create a scan the report (the results) is saved in a report file using XML format. When we use the OffCAT for displaying the report, we can relate to the OffCAT as “XML viewer”, that enable us to display the information and a “readable” and easy way.

We can use the reports for exam scan results from former scan or we can save the scan result (export the results) to an XML file. The major use of the ability to export the scan results to an XML file is that in a scenario in which we implemented all of the required troubleshooting steps and we still have problems with outlook, we can send the scan result to the office 365 support team for further examination and analysis.

In the following screenshot we can see that at the end of the scanning process, one of the available options is: Export report.

When we choose the option of: export report, the report will be saved as an XML file.

In case that we want to export a “former” OffCAT scan results, we can use the export option by using the main menu.

Open the OffCAT
On the left menu option choose the option: select a scan to view

In the following screenshot we can see the name of the available OffCAT scans

We can choose the option of: view a report of this scan. In this scenario the OffCAT serve as a “viewer” for the XML file that include the scan results.

In case that we want to export the scan result, we should choose the option: Export this scan

Additional reading

Download PDF File

You can download a PDF version of the instructions

Download

Now it’s Your Turn!
We really like to know what is your opinion on the Article

PLEASE SHARE

The Audit mailbox option is a very useful feature that enables us to get detailed information about all the operations, and the activities related to the “Mailbox” object. Generally speaking, there are couples of “audit type." In this article, I would like to focus upon the audit type described as: “Non-Owner Mailbox Access." This option enables us to get detailed information about: who did what and when relating to a specific mailbox.

The mailbox Auditing include 3 levels:

AuditOwner - information about operations\activities excited by the mailbox. owner. This audit option is not supported in Exchange Online (office 365) in the current time.

Non-Owner Mailbox Access audit

AuditAdmin - information about operations\activities excited by the administrator for a specific mailbox.
AuditDelegate - information about operations\activities excited by other recipients (delegated) for a specific mailbox.

The Non-Owner Mailbox Access audit is not enabled by default. The meaning is, that in case we want to use the “audit” option, we will need to “turn on” the audit. The option to audit mailbox is suitable for a scenario such as: when user complain that a mail is “disappearing” from his mailbox, and he have no idea how did this happened. Another scenario could be that we suspect the “someone” try to create unauthorized access to a user's mailbox and so on.

To optimize the access to the data in the document, you can use the option of “Expand All” or “Collapse All” for displaying\hiding all of the sub sections (colored in gray) or use the “+” sign

in each of the chapter headers (colored in blow).

white space

1 - Enable/Disable Mailbox Audit ( Non-Owner Mailbox Access Report )
2 - Set the Type of Mailbox Audit + the required information
3 - Display information about Audit settings
4 - Display information about mailbox and folder permissions
5 - Search for information in the Audit Log
6 - Audit General Settings
7 - Download PowerShell menu script

Information and help related to PowerShell

In case that you are a novice in the PowerShell environment, you can use the following link to get more information about the “first steps” such as: downloading the required PowerShell software components, how to use the PowerShell console, running a PowerShell script, etc.

Link Table

PowerShell Naming Conventions & general information

If you want to get more information about the Naming Conventions that we use for this article and get some general tips about: how to work with the PowerShell, read the article: Help and additional information - o365info.com PowerShell articles

Create remote PowerShell session

Before we can use the required PowerShell commands, we need to download and install the office 365 cmdlets + create remote PowerShell session to office 365 or Exchange Online. If you need more information about how to create a remote PowerShell session read the following articles: Part 2: Connect to Office 365 by using Remote PowerShell and Part 3: Connect to Exchange online by using Remote PowerShell

How to use a PowerShell script

Most of the PowerShell articles include a PowerShell script that simplifies the use of the PowerShell commands. If you want to get more information about: How to use a PowerShell script, read the article: Connect to office 365 and Exchange online using a script

PowerShell command and Script languish in more details

If you are new to the PowerShell world, you can read more information about PowerShell in office 365 environment in the article: The Power of PowerShell

txt

1 - Enable/Disable Mailbox Audit ( Non-Owner Mailbox Access Report )

Enable Mailbox Audit (Non-Owner Mailbox Access Report) for a specific mailbox

Code Box

 Set-Mailbox <Identity> -AuditEnabled $True

 Set-Mailbox John -AuditEnabled $True

Enable Mailbox Audit (Non-Owner Mailbox Access Report) for ALL mailbox’s (Bulk mode)

Code Box

PowerShell command syntax

 $UserMailboxes = Get-Mailbox -Filter {(RecipientTypeDetails -eq 'UserMailbox')} $UserMailboxes | ForEach {Set-Mailbox $_.Identity -AuditEnabled $True}

Disable Mailbox Audit (Non-Owner Mailbox Access Report) for a specific mailbox

Code Box

 Set-Mailbox <Identity> -AuditEnabled $False

 Set-Mailbox John -AuditEnabled $False

Disable Mailbox Audit (Non-Owner Mailbox Access Report) for ALL mailbox’s (Bulk mode)

Code Box

PowerShell command syntax

 $UserMailboxes = Get-Mailbox -Filter {(RecipientTypeDetails -eq 'UserMailbox')} $UserMailboxes | ForEach {Set-Mailbox $_.Identity -AuditEnabled $False}

2 - Set the Type of Mailbox Audit + Non default Audit operations

Set Mailbox Audit – AuditAdmin

Code Box

 Set-Mailbox <Identity> -AuditAdmin <list of operations>

 Set-Mailbox John -AuditAdmin Create,FolderBind,SendAs,SendOnBehalf,SoftDelete,HardDelete,Update,Move,MoveToDeletedItems

Set Mailbox Audit – Audit Delegate

Code Box

 Set-Mailbox <Identity> –AuditDelegate <list of operations>

 Set-Mailbox John -AuditDelegate Create,FolderBind,SendAs,SendOnBehalf,SoftDelete,HardDelete,Update,Move,MoveToDeletedItems

Enable Audit + Set Mailbox Audit for AuditAdmin and AuditDelegate

Code Box

PowerShell command syntax

Set-mailbox John -AuditEnabled $True -AuditDelegate Create,FolderBind,SendAs,SendOnBehalf,SoftDelete,HardDelete,Update,Move,MoveToDeletedItems -AuditAdmin Create,FolderBind,SendAs,SendOnBehalf,SoftDelete,HardDelete,Update,Move,MoveToDeletedItems

3 - Display information about Audit settings

Display information about Audit logging for a specific mailbox - AuditDelegate

Code Box

 Get-Mailbox <Identity> | Select-Object –ExpandProperty AuditDelegate

 Get-Mailbox John | Select-Object –ExpandProperty AuditDelegate

Display information about Audit logging for a specific mailbox - AuditAdmin

Code Box

 Get-Mailbox <Identity> | Select-Object -ExpandProperty AuditAdmin

 Get-Mailbox John | Select-Object -ExpandProperty AuditAdmin

Display information about recipient Audit folder

Code Box

 Get-MailboxFolderStatistics <Identity> | ? {$_.Name -eq "Audits" -and $_.FolderType -eq "Audits"} | FT Identity, ItemsInFolder, FolderSize -AutoSize

 Get-MailboxFolderStatistics John | ? {$_.Name -eq "Audits" -and $_.FolderType -eq "Audits"} | FT Identity, ItemsInFolder, FolderSize -AutoSize

Display information about all of the mailboxes that are Audited

Code Box

PowerShell command syntax

 Get-Mailbox | Where {$_.AuditEnabled -eq “$True”}

View administrator Audit logging settings

Code Box

PowerShell command syntax

 Get-AdminAuditLogConfig

4 - Display information about mailbox and folder permissions

Display information about Audit logging for a specific mailbox - AuditDelegate

Code Box

 Get-Mailboxfolder <Identity> -GetChildren | Get-MailboxFolderPermission | Where-Object {-not ($_.AccessRights -like '*None*')

 Get-Mailboxfolder John -GetChildren | Get-MailboxFolderPermission | Where-Object {-not ($_.AccessRights -like '*None*')

5 - Search for information in the Audit Log

Display all the Audit information that was collected for a specific mailbox

Code Box

  Search-MailboxAuditLog <Identity> -LogonTypes Admin,Delegate -ShowDetails

 Search-MailboxAuditLog  John -LogonTypes Admin,Delegate -ShowDetails

Display Audit information for “Send As” activities

Code Box

 Search-MailboxAuditLog <Identity> -LogonTypes Admin,Delegate -ShowDetails | Where-Object {$_.Operation -eq "Sendas"} |select MailboxResolvedOwnerName, LastAccessed, Operation,OperationResult,LogonUserDisplayName,LogonType ,ItemSubject,FolderPathName,InternalLogonType,SourceItemSubjectsList,SourceItemFolderPathNamesList,ClientProcessName,ClientInfoString

 Search-MailboxAuditLog John -LogonTypes Admin,Delegate -ShowDetails | Where-Object {$_.Operation -eq "Sendas"} | Select MailboxResolvedOwnerName, LastAccessed, Operation,OperationResult,LogonUserDisplayName,LogonType ,ItemSubject,FolderPathName,InternalLogonType,SourceItemSubjectsList,SourceItemFolderPathNamesList,ClientProcessName,ClientInfoString

Display Audit information about a mailbox from specific date range

Code Box

 Search-MailboxAuditLog <Identity> -LogonTypes Admin,Delegate –StartDate <mm/dd/yy> –EndDate <mm/dd/yy> –ResultSize <Number>

 Search-MailboxAuditLog John -LogonTypes Admin,Delegate -StartDate 05/20/2013 -EndDate 05/25/2013 -ResultSize 2000

Display Audit information about a mailbox from specific date range for “HardDelete” activities

Code Box

 Search-MailboxAuditLog <Identity> -LogonTypes Admin,Delegate –StartDate <mm/dd/yy> –EndDate <mm/dd/yy> –ResultSize <Number> | Where-Object {$_.Operation -eq "HardDelete"}

 Search-MailboxAuditLog John -LogonTypes Admin,Delegate -StartDate 05/20/2013 -EndDate 05/25/2013 -ResultSize 2000 | Where-Object {$_.Operation -eq "HardDelete"}

Display the content of the administrator audit log (show all events)

Code Box

PowerShell command syntax

 Search-AdminAuditLog

Search the contents of the administrator Audit log

Code Box

 Search-AdminAuditLog – Cmdlets <cmdlet 1, cmdlet 2, ...> –Parameters <Parameter 1, parameter 2, ...> –StartDate <Start date> –EndDate <End date> –UserIds <user IDs> –ObjectIds <object IDs> -IsSuccess <$True | $False >

 Search-MailboxAuditLog  John -LogonTypes Admin,Delegate -StartDate 05/20/2014 -EndDate 05/25/2014 -ResultSize 2000  Search-AdminAuditLog -Cmdlets Set-Mailbox -Parameters ProhibitSendQuota, ProhibitSendReceiveQuota, IssueWarningQuota, MaxSendsize, MaxReceiveSize -StartDate 05/20/2014 -EndDate  05/25/2014 -UserIds John,Alice,Bob  -IsSuccess $True

Search the contents of the administrator Audit log - look for specific user

Code Box

 Search-AdminAuditLog -UserIds <Identity>

 Search-AdminAuditLog -UserIds John

6 - Audit General Settings

Configure Outlook Web App to allow XML attachments

Code Box

PowerShell command syntax

 Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -AllowedFileTypes '.rpmsg','.xlsx','.xlsm','.xlsb','.tiff','.pptx','.pptm','.ppsx','.ppsm','.docx','.docm','.zip','.xls','.wmv','.wma','.wav','.vsd','.txt','.tif','.rtf','.pub','.ppt','.png','.pdf','.one','.mp3','.jpg','.gif','.doc','.bmp','.avi','.xml'

Set Audit retention number of days

Code Box

 Set-Mailbox <Identity> -AuditLogAgeLimit <Days>

 Set-Mailbox John -AuditLogAgeLimit 30

Suppressing Audits for Specific Mailboxes

Code Box

 Set-MailboxAuditBypassAssociation <Identity> -AuditBypassEnabled $True

 Set-MailboxAuditBypassAssociation John -AuditBypassEnabled $True

Mailbox Auditing: Export Audit information to XML File + Send the result to Email address

Code Box

 New-MailboxAuditLogSearch –Name <String> -LogonTypes Admin,Delegate –StartDate <mm/dd/yy> –EndDate <mm/dd/yy> –StatusMailRecipients <Email Address>

 New-MailboxAuditLogSearch -Name "Audit information for all mailboxes" -LogonTypes Admin,Delegate -StartDate 05/20/2014 -EndDate 05/25/2014 -StatusMailRecipients John@o365info.com

Administrator Auditing: Export Audit information to XML File + Send the result to Email address

Code Box

 New-AdminAuditLogSearch –Name <String> -LogonTypes Admin,Delegate –StartDate <mm/dd/yy> –EndDate <mm/dd/yy> –StatusMailRecipients <Email Address>

 New-AdminAuditLogSearch -Name "Audit information for all mailboxes" -LogonTypes Admin,Delegate -StartDate 05/20/2014 -EndDate 05/25/2014 -StatusMailRecipients John@o365info.com

Script Box

For your convent, I have “Wrapped” all of the PowerShell commands that was reviewed, In a PowerShell Script named: Audit.ps1

Download

Additional reading

Now it’s Your Turn!
We relay like to know what is your opinion on the Article

PLEASE SHARE

Latest Updates

Monday, March 24, 2014

Sunday, March 23, 2014

Before we begin

How does the OffCAT tool work?

Download and install the OffCAT tool

How to start an OffCAT scan

How to read\use the OffCAT scan results

How to Download Microsoft Hotfix

Reading and exporting the OffCAT report file

Download PDF File

Information and help related to PowerShell

1 - Enable/Disable Mailbox Audit ( Non-Owner Mailbox Access Report )

Enable Mailbox Audit (Non-Owner Mailbox Access Report) for a specific mailbox

Enable Mailbox Audit (Non-Owner Mailbox Access Report) for ALL mailbox’s (Bulk mode)

Disable Mailbox Audit (Non-Owner Mailbox Access Report) for a specific mailbox

Disable Mailbox Audit (Non-Owner Mailbox Access Report) for ALL mailbox’s (Bulk mode)

2 - Set the Type of Mailbox Audit + Non default Audit operations

Set Mailbox Audit – AuditAdmin

Set Mailbox Audit – Audit Delegate

Enable Audit + Set Mailbox Audit for AuditAdmin and AuditDelegate

3 - Display information about Audit settings

Display information about Audit logging for a specific mailbox - AuditDelegate

Display information about Audit logging for a specific mailbox - AuditAdmin

Display information about recipient Audit folder

Display information about all of the mailboxes that are Audited

View administrator Audit logging settings

4 - Display information about mailbox and folder permissions

Display information about Audit logging for a specific mailbox - AuditDelegate

5 - Search for information in the Audit Log

Display all the Audit information that was collected for a specific mailbox

Display Audit information for “Send As” activities

Display Audit information about a mailbox from specific date range

Display Audit information about a mailbox from specific date range for “HardDelete” activities

Display the content of the administrator audit log (show all events)

Search the contents of the administrator Audit log

Search the contents of the administrator Audit log - look for specific user

6 - Audit General Settings

Configure Outlook Web App to allow XML attachments

Set Audit retention number of days

Suppressing Audits for Specific Mailboxes

Mailbox Auditing: Export Audit information to XML File + Send the result to Email address

Administrator Auditing: Export Audit information to XML File + Send the result to Email address

Script Box

Feature Label 3

r

Labels

Popular Posts

Follow on FaceBook

Follow on Google+

Blog Archive

Follow Templateism

Followers

Popular Posts