Find who deleted a calender item from our CEO outlook

PowerShell Help
1

Hello All, Newbie to PS and I am having a had time understanding a script task. Allow me to explain.
I have a client whos calendar is missing items, the issue is he doesn’t know when it went missing and I ran a calendar audit and i found who as auditor rights, but now i need to see who deleted anything from his outlook this includes calendars and email.

the details i need to present - who accessed it name (userID) / date and time / what they deleted, the subject of the event.

here is the code: (if you have something shorter and easier, please post ) :slight_smile:

#Modify the values for the following variables to configure the audit log search.
$logFile = “c:\AuditLogSearch\AuditLogSearchLog.txt”
$outputFile = “c:\AuditLogSearch\AuditLogRecords.csv”
[DateTime]$start = [DateTime]::UtcNow.AddDays(-12)
[DateTime]$end = [DateTime]::UtcNow
$record = “ExchangeItemGroup”
$resultSize = 5000
$intervalMinutes = 60

#Start script
[DateTime]$currentStart = $start
[DateTime]$currentEnd = $end

Function Write-LogFile ([String]$Message)
{
$final = [DateTime]::Now.ToUniversalTime().ToString(“s”) + “:” + $Message
$final | Out-File $logFile -Append
}

Write-LogFile “BEGIN: Retrieving audit records between $($start) and $($end), RecordType=$record, PageSize=$resultSize.”
Write-Host “Retrieving audit records for the date range between $($start) and $($end), RecordType=$record, ResultsSize=$resultSize”

$totalCount = 0
while ($true)
{
$currentEnd = $currentStart.AddMinutes($intervalMinutes)
if ($currentEnd -gt $end)
{
$currentEnd = $end
}

if ($currentStart -eq $currentEnd)
{
    break
}

$sessionID = [Guid]::NewGuid().ToString() + "_" +  "ExtractLogs" + (Get-Date).ToString("yyyyMMddHHmmssfff")
Write-LogFile "INFO: Retrieving audit records for activities performed between $($currentStart) and $($currentEnd)"
Write-Host "Retrieving audit records for activities performed between $($currentStart) and $($currentEnd)"
$currentCount = 0

$sw = [Diagnostics.StopWatch]::StartNew()
do
{
    $results = Search-UnifiedAuditLog -StartDate $currentStart -EndDate $currentEnd -RecordType $record -SessionId $sessionID -SessionCommand ReturnLargeSet -ResultSize $resultSize

    if (($results | Measure-Object).Count -ne 0)
    {
        $results | export-csv -Path $outputFile -Append -NoTypeInformation

        $currentTotal = $results[0].ResultCount
        $totalCount += $results.Count
        $currentCount += $results.Count
        Write-LogFile "INFO: Retrieved $($currentCount) audit records out of the total $($currentTotal)"

        if ($currentTotal -eq $results[$results.Count - 1].ResultIndex)
        {
            $message = "INFO: Successfully retrieved $($currentTotal) audit records for the current time range. Moving on!"
            Write-LogFile $message
            Write-Host "Successfully retrieved $($currentTotal) audit records for the current time range. Moving on to the next interval." -foregroundColor Yellow
            ""
            break
        }
    }
}
while (($results | Measure-Object).Count -ne 0)

$currentStart = $currentEnd

}

Write-LogFile “END: Retrieving audit records between $($start) and $($end), RecordType=$record, PageSize=$resultSize, total count: $totalCount.”
Write-Host “Script complete! Finished retrieving audit records for the date range between $($start) and $($end). Total count: $totalCount” -foregroundColor Green

2

You seem to have forgotten to ask a question. What’s wrong with the code?

3

If the code works, then it works. That is all that matters initially. Improving it comes with experimenting and experience.

Does it work?

4

Mr. Sir Knight,
Welcome to the forum. :wave:t4:

before we proceed …
When you post code, sample data, console output or error messages please format it as code using the preformatted text button ( </> ). Simply place your cursor on an empty line, click the button and paste your code.

Thanks in advance

How to format code in PowerShell.org <---- Click :point_up_2:t4: :wink:

Then … this forum is for scripting questions. If you need a review or refactoring you may ask a trained professional to do it for you or you may try it there: