Hi,
I am using a script to export mailbox audit log, but it is by default generating the report in HTML, Our requirement is to generate the report in CSV or in Excel file and also wanted to put a date range so that instead of looking for beaging the script will export the report for a specified date. I really don't understand powershell much. Please guide me. Below is the script I am using
<#
.SYNOPSIS
Creates a HTML Report to show Mailbox Audit Logs for a single Exchange 2010 Mailbox or all AuditEnabled Mailboxes.
Serkan VAROGLU
http:\\Mshowto.org
http:\\Get-Mailbox.org
Twitter:@SRKNVRGL
THIS CODE IS MADE AVAILABLE AS IS, WITHOUT WARRANTY OF ANY KIND. THE ENTIRE
RISK OF THE USE OR THE RESULTS FROM THE USE OF THIS CODE REMAINS WITH THE USER.
Version 1.0, 15 March 2012
.DESCRIPTION
Creates a HTML Report to show Mailbox Audit Logging for Exchange 2010 Mailbox or Mailboxes.
.PARAMETER Mailbox
If you want to report a single mailbox use "Mailbox" parameter with alias input.
.SWITCH All
If you want to report all AuditEnabled mailboxes use "All" switch.
.SWITCH UniqueFileName
If you use UniqueFileName switch the output name will be "SAMAccountName-DayMonthYear-HourMinuteSecond.html" (Example: srknvrgl-15032012-163420.html)
.IMPORTANT NOTES
-Please make sure you have write permission on the folder that you are running the script from.
-If you use All switch and Mailbox Parameter at the same time. All switch will be used.
-By default the report will be generated as "SAMAccountName.html" (Example: srknvrgl.html)in the directory that you ran the script from.
-If you are running the script in scheduled intervals you might want to use UniqueFileName switch to keep all versions if not the report will be overridden.
.EXAMPLES
For a Single Mailbox
.\Report-MailboxAuditLog -Mailbox srknvrgl
For all AuditEnabled Mailboxes
.\Report-MailboxAuditLog -All
For a Single Mailbox with Unique File Name Output
.\Report-MailboxAuditLog -Mailbox srknvrgl -UniqueFileName
For all mailboxes with Unique File Name Output
.\Report-MailboxAuditLog -All -UniqueFileName
#>
param (
[Parameter(Position=0,Mandatory=$false,ValueFromPipeline=$false)][string]$Mailbox,
[Parameter(Position=1,Mandatory=$false,ValueFromPipeline=$false)][switch]$All,
[Parameter(Position=2,Mandatory=$false,ValueFromPipeline=$false)][switch]$UniqueFileName
)
$Watch = [System.Diagnostics.Stopwatch]::StartNew()
$WarningPreference="SilentlyContinue"
$ErrorActionPreference = "Silentlycontinue"
if ((!$All) -and (!$Mailbox)){Write-host -ForegroundColor Red "Please use either Mailbox parameter or All switch. ""All"" switch will let you report all mailboxes. ""Mailbox"" Parameter will report a single mailbox"
exit}
function _Progress
{
param($PercentComplete,$Status)
Write-Progre`ss -id 1 -activity "Report for Mailboxes" -status $Status -percentComplete ($PercentComplete)
}
_Progress (10) "Searching accounts with Audit ByPass Enabled"
#Find accounts with Audit ByPass Association
$bypassenabled=Get-MailboxAuditBypassAssociation -resultsize unlimited | ?{$_.AuditBypassEnabled -eq $True}
function auditreport
{
param($Mailbox)
$c=0
$MailboxName=Get-Mailbox $Mailbox -ErrorAction SilentlyContinue
if (!$MailboxName) {Write-host -ForegroundColor Red "Please make sure you typed correct alias! Script couldn't find any mailbox with that alias!"} else
{
if($MailboxName.AuditEnabled -eq $False) {Write-host -ForegroundColor Red "Audit Logging is not enabled on this Mailbox!"} else
{
#Get Number of Events
$auditsummary=Get-MailboxFolderStatistics $MailboxName.WindowsEmailAddress -FolderScope RecoverableItems | ?{$_.Name -eq "Audits"}
#Collect MailboxAudit Log for the mailbox
$audit=Search-MailboxAuditlog $MailboxName.WindowsEmailAddress -ShowDetails -Resultsize 250000
#What is monitored for Admin Access
Foreach ($Action in $MailboxName.AuditAdmin)
{
$AdminActions+="$Action"
$AdminActions+=" , "
}
#What is monitored for Delegate Access
Foreach ($Action in $MailboxName.AuditDelegate)
{
$DelegateActions+="$Action"
$DelegateActions+=" , "
}
#What is monitored for Owner
Foreach ($Action in $MailboxName.AuditOwner)
{
$OwnerActions+="$Action"
$OwnerActions+=" , "
}
#Calculate Item Count in each Event
Foreach ($event in $audit)
{
If (!($event.ItemId))
{
$SourceItemCount=($event.SourceItems | measure-object).count
}
else
{
$SourceItemCount=($event.ItemId | measure-object).count
}
$EventTbldata+="<tr><td>$($event.Operation)"
$EventTbldata+="<td>$($event.OperationResult)</td>"
$EventTbldata+="<td>$($event.LogonUserDisplayName)</td>"
$EventTbldata+="<td>$($event.LogonType)</td>"
$EventTbldata+="<td>$($event.ClientInfoString)</td>"
$EventTbldata+="<td>$($event.ClientIPAddress)</td>"
$EventTbldata+="<td>$($event.FolderPathName)</td>"
$EventTbldata+="<td>$($event.ItemSubject)</td>"
$EventTbldata+="<td>$($SourceItemCount)</td>"
$EventTbldata+="<td>$($event.LastAccessed)</td></tr>"
}
$Header="<html><body>
<font size=""1"" face=""Arial,sans-serif"">
<h3 align=""center"">$($MailboxName) Mailbox Audit Log Report</h3>
<a name=""top""><h4 align=""center"">Generated $((Get-Date).ToString())</h4></a>"
$EventTblHeader="<table border=""1"" bordercolor=""#4384D3"" cellpadding=""3"" style=""font-size:8pt;font-family:Arial,sans-serif"" width=""100%""><tbody>
<tr bgcolor=""#4384D3"" align=""center"">
<td><font color=""#FFFFFF"">Operation</font></td>
<td><font color=""#FFFFFF"">Operation Result</font></td>
<td><font color=""#FFFFFF"">Logon User Display Name</font></td>
<td><font color=""#FFFFFF"">Logon Type</font></td>
<td><font color=""#FFFFFF"">Client Info</font></td>
<td><font color=""#FFFFFF"">Client IP Address</font></td>
<td><font color=""#FFFFFF"">Folder Path</font></td>
<td><font color=""#FFFFFF"">Item Subject</font></td>
<td><font color=""#FFFFFF"">Item Count</font></td>
<td><font color=""#FFFFFF"">Last Accessed</font></td>
</tr>
"
$EventTbl=$EventTblHeader+$EventTbldata+"</tbody></table>"
$Footer="<font size=""1"" face=""Arial,sans-serif"">Scripted by <a href=""Serkan">http://www.get-mailbox.org"">Serkan
Varoglu</a>.
Elapsed Time To Complete This Report: $($Watch.Elapsed.Minutes.ToString()):$($Watch.Elapsed.Seconds.ToString())</font></body></html>"
$BypassTbl0="<center><table style=""font-size:8pt;font-family:Arial,sans-serif"" border=""1"" bordercolor=""#FFE87C"" cellpadding=""3""><tr
align=""center""><td bgcolor=""#FFE87C"" colspan=""10"">Mailbox Audit Bypass Association is Enabled on these accounts. These accounts are not logged in Audit Logging.</td></tr><tr>"
foreach ($bypass in $bypassenabled)
{
if ($c -eq 10)
{
$BypassTbl1+="</tr><tr><td>$($bypass.name)</td>"
$c=1
}
else
{
$BypassTbl1+="<td>$($bypass.name)</td>"
$c++
}
}
$BypassTbl2="</tr></table></center>"
if (!$bypassenabled)
{
$BypassTbl=""
}
else
{
$BypassTbl=$BypassTbl0+$BypassTbl1+$BypassTbl2
}
$MailboxTbl="
<table border=""1"" bordercolor=""#4384D3"" cellpadding=""3"" style=""font-size:8pt;font-family:Arial,sans-serif"" width=""100%"">
<tbody>
<tr bgcolor=""#4384D3"" align=""center"">
<td><font color=""#FFFFFF"">Total Events</font></td>
<td><font color=""#FFFFFF"">Audit Events Logged for Admin</font></td>
<td><font color=""#FFFFFF"">Audit Events Logged for Delegates</font></td>
<td><font color=""#FFFFFF"">Audit Events Logged for Mailbox Owner</font></td>
</tr>
<tr>
<td>$($auditsummary.ItemsInFolder)</td>
<td>$($AdminActions)</td>
<td>$($DelegateActions)</td>
<td>$($OwnerActions)</td>
</tr>
</tbody>
</table>
"
if (!$auditsummary)
{
$Output=$Header+$BypassTbl+"<br>"+$MailboxTbl+"<br><center>Nothing Logged Yet.<br></center>"+$Footer
}
else
{
$Output=$Header+$BypassTbl+"<br>"+$MailboxTbl+$EventTbl+$Footer
}
$t = Get-Date -UFormat %d%m%Y-%H%M%S
if($UniqueFileName.Ispresent -eq $True)
{
$HTMLReport = "$($MailboxName.WindowsEmailAddress)-$t.html"
}
else
{
$HTMLReport = "$($MailboxName.WindowsEmailAddress).html"
}
$Output | Out-File $HTMLReport
Write-Host "Report for " $MailboxName " : " $HTMLReport
}
}
}
if ($All.Ispresent-eq $True)
{
$AllMailboxes=Get-Mailbox -ResultSize Unlimited| ?{$_.AuditEnabled -eq $True}
foreach ($AllMailbox in $AllMailboxes)
{
_Progress (($i*95)/($Allmailboxes).count) "Generating Report for $AllMailbox"
auditreport $AllMailbox.DistinguishedName
$i++
}
}
else
{
_Progress (70) "Generating Report for $Mailbox"
auditreport $Mailbox
}