Exchange mailbox Monitoring

This topic contains 2 replies, has 2 voices, and was last updated by Profile photo of Leon Ashton L Leon Ashton L 1 year, 2 months ago.

  • Author
    Posts
  • #31401
    Profile photo of Leon Ashton L
    Leon Ashton L
    Participant

    I am currently running a (Very Basic) PowerShell script as a scheduled task to monitor a users mailbox access on a daily basis but have now been asked to amend the results so that the only results which are included in the report are entries where the time is NOT within the hours of 9AM – 5PM.
    The current code is;
    Search-MailboxAuditLog -Identity "Joe Bloggs" -ShowDetails | where LogonUserDisplayName -eq "Joe Bloggs" | select LogonUserDisplayName,LastAccessed,LogonType,Operation,OperationResult,LastAccessed

    I was thinking that maybe I need to construct a loop for this to convert the values output for the "LastAccessed" Property to display just a time, something similar to this;
    $DateTimes = Search-MailboxAuditLog -Identity "Joe Bloggs" -ShowDetails | where Logonuser -eq "Joe Bloggs" | select -Property lastaccessed
    ForEach ($DateTime in $DateTimes) {
    Get-Date -Format t
    }
    Or maybe I need to use the -Split switch to help me...

    Before somehow outputting the results using the Where-Object command.

    Probably a very basic problem for most of you to resolve, however I still consider myself a beginner!

  • #31408
    Profile photo of Max Kozlov
    Max Kozlov
    Participant

    may be something like

    [...] | where-object { $_.LastAccessed.Hour -gt 17 -or $_.LastAccessed.Hour -lt 9 }

    ?

  • #31421
    Profile photo of Leon Ashton L
    Leon Ashton L
    Participant

    Many thanks for the feedback Max – I simply added this in after the first Where-Object Command and it worked. For anyone interested the full script is below, which includes some CSS formatting;

    [powershell]
    $css = @"

    table {
    border-spacing: 0px;
    border-collapse: collapse;
    background: #FFFFFF;
    border: 2px solid #000000;
    font-family:arial;
    }
    table td {
    text-align: left;
    border: 0px;
    border-bottom: 2px solid #000000;
    border-left: 2px solid #000000;
    padding: 0.1em 0.5em;
    font-family:arial;
    color: #000000
    }
    table th {
    text-align: left;
    font-weight: bold;
    background-color: #712b91;
    padding: 0.1em 0.5em;
    color: #FFFFFF;
    border: 2px solid #000000;
    font-family:arial;
    }

    "@
    Search-MailboxAuditLog -Identity "Joe Bloggs" -ShowDetails | where-object LogonUserDisplayName -eq "Joe Bloggs" | where {$_.LastAccessed.Hour -gt 17 -or $_.LastAccessed.Hour -lt 9} | select logonuserdisplayname,lastaccessed,logontype,operation,operationresult |
    ConvertTo-Html -Head $css | out-file c:\MailboxAudit.html

You must be logged in to reply to this topic.