Exchange 2010 Administrator Audit Log – script

Till now we wrote two articles about Adminstrator Audit Log.

First described how to enable and configure Administrator Audit Log:

Exchange 2010 Administrator Audit Log – configuration

in second we explained how to search Administrator Audit Log:

Exchange 2010 Administrator Audit Log – search logs

 

Now we will describe how to automate search of Administrator Audit Log.

During Administrator Audit Log configuration we set, how long audit logs will be stored in a hidden arbitration mailbox.

The command you to configure how long the logs should be kept are presented below:

Set-AdminAuditLogConfig -AdminAuditLogAgeLimit 60.00:00:00

 

To specify a value of days, use the format dd.hh:mm:ss so in this example logs will be kept for 60 days.

Continue reading

Distribution Groups nested – get list only groups

Recently, we described how to obtain a list of all mailboxes in the group that has nested distribution groups.

Unfortunately, using this method, you can not get a list of groups in a distribution group, only users (mailboxes).

To obtain this list, you need to write more or less complicated powershell script or use the additive Quest Powershell Module for Active Directory.

 

After installation of Quest Module, run powershell console and run:

add-PSSnapin quest.activeroles.admanagement

Continue reading

Microsoft Exchange get sent emails list – messagetrackinglog

emailRecently we wrote about how to find all the all recipients of the email:

Exchange MessageTrackingLogs get recipients list

 

 

Now we will present a powershell script that will help us generate statistics of sent emails.

 

However, we are not interested in the amount of all outgoing e-mails, their size, but we will focus on emails sent outside of our Exchange organization and get information about the addresses from which they were sent, with which the subject, how many of these emails and how many recipients receive those emails.

This script allows you to obtain information about the senders e-mail addresses that send many messages out.
This script is based on checking the Transport Logs located on Exchange servers with the Hub Transport roles.

After receiving the results of the script you can use the script in the previous post and find out to whom the message was sent, then you will get list of all recipients of this email.

 

Below we explain how this script work.:

First script part conatins:

  • powershell object definitions
  • paths to output files with emails statistic
  • settings to send email with alert to admin
  • $MAX_Recipients – number of recipients which define when to generate alert sent by email

 

Add-PSSnapin Microsoft.Exchange.Management.PowerShell.E2010
Set-AdServerSettings -ViewEntireForest $True

Function New-Array {,$args}

$Report = New-Array
$Report_SMTP = New-Array
$Rep_sum = New-Array
$Rep_SMTP_sum = New-Array

$data = $($((get-date).adddays(-1)).ToString('yyyy.MM.dd'))

#paths to output files
$Out_Rep_file = "d:\Scripts\Logs\Stats\msg_stat_out_$data.csv"
$Out_Rep_sum_file = "d:\Scripts\Logs\Stats\msg_stat_out_sum_$data.csv"

#files with emails with smtp traffic
$Out_Rep_SMTP_file = "d:\Scripts\Logs\Stats\msg_stat_smtp_out_$data.csv"
$Out_Rep_SMTP_sum_file = "d:\Scripts\Logs\Stats\msg_stat_smtp_out_sum_$data.csv"
#file with report attached to email (emails recipients grater than $MAX_Recipients)
$Email_HTML_File = "d:\Scripts\Logs\Stats\Report_outgoing_emails_$data.htm"

#settings for email with report
$mail_from = "exchangereport@domain.com"
$mail_to = "admin@domain.com"
$mail_smtp_host = "smtpserver.domain.local"
$mail_subject = "Report outgoing emails $data"

#variable that defines the threshold for recipients to write to email report
$MAX_Recipients = 100

Continue reading

Exchange MessageTrackingLogs get recipients list

From time to time we need to get a list of all persons to whom the email was sent with a given subject.

The list of recipients in a fairly simple way we can get from the transaction logs which are located on Exchange servers with HT roles.

Of course, before you do this, you have to configure your environment so that the transaction logs are kept for a few days on the servers.

The following script returns a list of recipients to whom the email was sent with the subject “Test mail”, but we are interested in the time of dispatch of the last day.

Number of days is defined in $DAYS and subject in $SUBJECT.

Script you can find below:

Continue reading

List Exchange mailbox folder permissions – script

Sometimes you add permissions to mailbox folders for other users.

You can check permission to mailbox folder using Outlook but then you need to check each folder.

If you want to get list of permissions assigned for users to specified mailbox folders you can use below script.

In this script we use Get-MailboxFolderStatistics to get list of mailbox folders and subfolders, and  Get-MailboxFolderPermission to get permissions assigned to those folders and subfolders.

When we connect both commands we will get script which will list all permissions assigned to all folders and subfolders in mailbox.

To check specified mailbox, assign mailbox alias or smtp address to variable $MBX_tocheck

Continue reading