Author Posts

January 19, 2017 at 3:09 pm

Hi,

I'm trying to get this working but my head hurts right now....
(Exchange Online script)

$Hours = Read-Host "How many hours do you want to check?"
Search-MailboxAuditLog -Identity $User -LogonTypes Owner -ShowDetails -StartDate (Get-Date).AddHours(-$Hours) -EndDate (Get-Date) | Export-Csv C:\PowerShell\Office365\Files\Audit-$User.csv -Encoding UTF8 -NoTypeInformation -Delimiter ";"

If I run that command without Export-CSV, it shows only the last 2 hours records.
When I use the Export-CSV it exports all the records, not just the only 2 hours records.
Tried sending the info to a variable and then exporting, but is happening the same...
Anyone with an idea of why this is happening??

January 19, 2017 at 3:30 pm

You most likely need to filter the results yourself. I am not familiar with this command, but if your description is accurate, the start and end dates are only applied when displaying the results. You'll have to add a where-object in the pipeline to select the window you want to see in the file.

January 19, 2017 at 4:20 pm

Ron,

Thanks... But nevermind, I came here to tell that it was a weird error in the fileserver.
Tried with a different file name and now is working.

Thanks again!