Office365 PowerShell打開郵箱審計功能
阿新 • • 發佈：2017-08-15
securescore mailbox auditing
/* */"
$secureStringPwd = gc C:\temp\key.txt | ConvertTo-SecureString
$creds = New-Object System.Management.Automation.PSCredential -ArgumentList $username, $secureStringPwd
$ExoSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $creds -Authentication Basic -AllowRedirection
Import-PSSession $ExoSession
}
#Find Mailboxes that haven‘t enabled auditing
$users=get-mailbox -Filter {AuditEnabled -eq $false} | select name, alias, auditenabled, auditlogagelimit, distinguishedname
foreach($user in $users){
try{
Set-Mailbox $user.distinguishedname -AuditEnabled $true -AuditLogAgeLimit 365 -AuditOwner Create,HardDelete,MailboxLogin,MoveToDeletedItems,SoftDelete,Update -ErrorAction Stop
# Create a Windows Eventlog if needed
$username=$user.name
Write-Eventlog -Logname ‘Application‘ -Source ‘Application‘ -EventID 666 -EntryType Information -Message "$username Maibox Auditing is enabled"
}
catch{
Write-Eventlog -Logname ‘Application‘ -Source ‘Application‘ -EventID 667 -EntryType Error -Message "$user Mailbox Auditing is failed to enable"
}
}
#There are two ways to check the resut, Event Viewer or Email
#Check again if the status is changed
$result=foreach($user in $users){
get-mailbox $user.name | select name, alias, auditenabled, auditlogagelimit, distinguishedname
}
#Send Email to the admin
$from = "[email protected]最近總公司要求Office365需要在所有的郵箱上面打開審計功能。這個功能沒法通過圖形界面操作，只能通過powershell腳本實現。
微軟提供了一個官方的腳本，不過裏面有個小bug
https://technet.microsoft.com/en-us/library/dn879651.aspx#step2
當多個用戶賬戶存在相同的alias的時候，他會很奇怪的認為是重名的賬戶，然後無法修改對應的幾個賬戶，因此不建議直接用get-mailbox | set-mailbox 修改數據，而是手動地for循環處理。
另外還有一個很2的地方是，Office365不能設置默認打開審計，因此所有的新賬戶都是沒有打開的。豆子只能設置一個計劃任務，讓腳本每天自動執行來修改新賬戶的設定。
另外，執行完了之後，我希望把修改過的賬戶都給我發一份郵件通知一下，另外最後windows也給我寫個日誌，以便日後查看。
下面是完整的腳本
#Create a secure string of the your password
#Read-Host -AsSecureString | ConvertFrom-SecureString > c:\temp\key.txt
#Check if O365 session is setup, if not, create a new one
$Sessions=Get-PSSession
if (($Sessions.ComputerName -eq "outlook.office365.com") -and ($Sessions.State -ne ‘Broken‘)){
write-host "Detect existing Office365 session, skip.." -ForegroundColor Cyan
}
else{
$username = "[email protected]
