I'm trying to get this working but my head hurts right now....
(Exchange Online script)
$Hours = Read-Host "How many hours do you want to check?"
Search-MailboxAuditLog -Identity $User -LogonTypes Owner -ShowDetails -StartDate (Get-Date).AddHours(-$Hours) -EndDate (Get-Date) | Export-Csv C:\PowerShell\Office365\Files\Audit-$User.csv -Encoding UTF8 -NoTypeInformation -Delimiter ";"
If I run that command without Export-CSV, it shows only the last 2 hours records.
When I use the Export-CSV it exports all the records, not just the only 2 hours records.
Tried sending the info to a variable and then exporting, but is happening the same...
Anyone with an idea of why this is happening??
You most likely need to filter the results yourself. I am not familiar with this command, but if your description is accurate, the start and end dates are only applied when displaying the results. You'll have to add a where-object in the pipeline to select the window you want to see in the file.