Author: Steve Man

Scenario: The search-MailboxAuditLog command has been deprecated and is no longer producing results. It is now replaced with the search-unifiedAuditLog which pulls in lots of data from various sources, not just Exchange.

I need a simple command to search a mailbox for activity and have it display results similar to before.

Commands:

#Pull Log data into a Variable from Exchange Online PowerShell
#I am running 3 separate searches since the logs cap out at 5000 and adding them all into the $logs variable

$Logs += Search-UnifiedAuditLog -StartDate 3/31/2025 -EndDate 4/3/2025 -UserIds steveman -RecordType ExchangeItem -ResultSize 5000

$Logs += Search-UnifiedAuditLog -StartDate 4/3/2025 -EndDate 4/5/2025 -UserIds steveman -RecordType ExchangeItem -ResultSize 5000

$Logs += Search-UnifiedAuditLog -StartDate 4/5/2025 -EndDate 4/8/2025 -UserIds steveman -RecordType ExchangeItem -ResultSize 5000

#The results that we are after are in JSON.  I am going to get it into a form that is usable within PowerShell or CSV:


 $logResults = foreach ($entry in $logs) {
    if ($entry.AuditData) {
        $entry | Add-Member -MemberType NoteProperty -Name AuditDataJson -Value (ConvertFrom-Json $entry.AuditData) -Force
        $entry
    }
}

#Now I am going to pick out the common stuff that I am after, feel free to add to it.

$Logs_Cleaned = $Logresults.auditdatajson | Select ClientInfoString, CreationTime, Operation, ResultStatus, ClientIP, userID, @{Name="Subject";Expression={$_ | Select -ExpandProperty Item | Select -expandproperty Subject}}, @{Name='ModifiedProperties';Expression={$_.ModifiedProperties -join ','}}

#Now to view it, export it, whatever you want to do, you can just reference the $logs_Cleaned variable.

$Logs_Cleaned

#-or

$Logs_Cleaned  | Out-gridview

#-or

$Logs_Cleaned | export-csv c:\temp\data.csv

Scenario: Below are my notes for testing the ‘New Outlook’ client within your Microsoft 365 version of Outlook. More to come soon.


As of 2/12/2024:

Client Protocol: ’New Outlook’ uses OWA. MAPI is the client protocol used in the ‘Old Outlook’ versions (Microsoft 365, 2019, 2016).


Search: I can easily search the Primary and Archive mailbox from a single Search


PST/OST Files: The ‘New Outlook’ does not yet support offline files


Sweep: Sweep is sweet. Since it’s OWA-based, you can sweep emails via this client.


Access to Shared Mailboxes: Yes, you can access shared mailboxes. However, it has moved to a folder called “Shared with me” in-line with the root folders of your mailbox.  Originally, shared mailboxes were opened a separate mailbox located on the navigational panel where your mailbox/folders exist.


Access to Archive Mailbox: Yes. It’s now located in the “In-Place Archive” folder inline with other root mail folders. It is no longer outside of the primary mailbox.


Look and Feel: It looks and feels like OWA. This client feels lightweight, and does not feel as heavy as the original Outlook client. Because it feels light, I am sure this increases the potential for this client to be missing something important to somebody. Common functionality seems to exist in this client.

It does open multiple ‘New Outlook’ windows if I accidentally click on the full client outlook icon multiple times. Thats annoying.


Rules: The rules in this ‘New Outlook’ are limited to rules you can create in OWA. The full client of Outlook has always been rich in its ruleset and offered conditions and features that were not available for server-side rules. These were commonly known as client-side rules. These rule bells and whistles that are available in the full client, do not appear to be available in the ‘New Outlook’.


CoPilot: The CoPilot technology within this ‘New Outlook’ client (And OWA on the Web) is pretty sweet. The suggestions that CoPilot offers to help draft a new message is helpful, BUT may be a little too formal for my liking. The summary by CoPilot, that automatically reads the email and provides the key points, have been pretty spot on. 

Scenario: You want to use LogParser via PowerShell to extract the usernames for all successful authentication attempts to Exchange On-Premises.

Scriptlet:

#Servers
$Servers = get-exchangeserver | Sort Name

#results
$EWS_Results = @()
$MAPI_Results = @()
$OWA_Results = @()
$ECP_Results = @()
$PS_Results = @()
$EAS_Results = @()


#LogParser Loop
$servers.name | %{
    $n = $_
    $logs = get-childitem \\$_\c$\inetpub\logs\logfiles\W3SVC1\*.log

    $logs.fullname | %{
        $l = $_ 
"Searching logs on $l"
"...EWS"
$ews_results += & "C:\Program Files (x86)\Log Parser 2.2\logparser.exe" -i:IISW3C -q:on -rtp:-1 @"
SELECT count(*) as hits, cs-username  from '$l' Where SC-Status=200  AND  cs-uri-stem LIKE '%ews%' AND cs-username NOT LIKE '%healthmailbox%' AND cs-username NOT LIKE 'S-1%' GROUP BY cs-username order by hits desc
"@
"...MAPI"
$MAPI_results += & "C:\Program Files (x86)\Log Parser 2.2\logparser.exe" -i:IISW3C -q:on -rtp:-1 @"
SELECT count(*) as hits, cs-username  from '$l' Where SC-Status=200  AND  cs-uri-stem LIKE '%mapi%' AND cs-username NOT LIKE '%healthmailbox%' AND cs-username NOT LIKE 'S-1%' GROUP BY cs-username order by hits desc
"@

"...OWA"
$OWA_results += & "C:\Program Files (x86)\Log Parser 2.2\logparser.exe" -i:IISW3C -q:on -rtp:-1 @"
SELECT count(*) as hits, cs-username  from '$l' Where SC-Status=200  AND  cs-uri-stem LIKE '%owa%' AND cs-username NOT LIKE '%healthmailbox%' AND cs-username NOT LIKE 'S-1%' GROUP BY cs-username order by hits desc
"@

"...ECP"
$ecp_results += & "C:\Program Files (x86)\Log Parser 2.2\logparser.exe" -i:IISW3C -q:on -rtp:-1 @"
SELECT count(*) as hits, cs-username  from '$l' Where SC-Status=200  AND  cs-uri-stem LIKE '%ecp%' AND cs-username NOT LIKE '%healthmailbox%' AND cs-username NOT LIKE 'S-1%' GROUP BY cs-username order by hits desc
"@

"...PS"
$PS_results += & "C:\Program Files (x86)\Log Parser 2.2\logparser.exe" -i:IISW3C -q:on -rtp:-1 @"
SELECT count(*) as hits, cs-username  from '$l' Where SC-Status=200  AND  cs-uri-stem LIKE '%powershell%' AND cs-username NOT LIKE '%healthmailbox%' AND cs-username NOT LIKE 'S-1%' GROUP BY cs-username order by hits desc
"@

"...EAS"
$EAS_results += & "C:\Program Files (x86)\Log Parser 2.2\logparser.exe" -i:IISW3C -q:on -rtp:-1 @"
SELECT count(*) as hits, cs-username  from '$l' Where SC-Status=200  AND  cs-uri-stem LIKE '%activesync%' AND cs-username NOT LIKE '%healthmailbox%' AND cs-username NOT LIKE 'S-1%' GROUP BY cs-username order by hits desc
"@
    }
}

#View:
$EWS_Results
$MAPI_Results
$OWA_Results 
$ECP_Results 
$PS_Results 
$EAS_Results

Scenario: I have a bunch of scripts that run via Scheduled Tasks. I need to identify what account the scripts are executing under AND what script is running.

My 2 goals are:
1. Identify the security account used to run the script. I will then manually replace the older account with my newer account.

2. Identify a list of scripts and perform a search in each script to see if there are any references to an older server listed. I will then manually replace the value if the old server name is listed,


Resolution:

Goal 1: The $Tasks below will show me the script location AND which security account the script runs under.

#Identify a list of Tasks where I manually specify the task path for where I put my tasks:

        $Tasks = @()
        $Tasks = Get-ScheduledTask -TaskPath "\Custom Tasks\*" | Where state -ne "Disabled"
        $Tasks = Get-ScheduledTask -TaskPath "\Exchange Tasks\*" | Where state -ne "Disabled"
        $Tasks += Get-ScheduledTask -TaskPath "\"| Where state -ne "Disabled"


#Pull in the Info
        $Tasks = $tasks | where taskname -notlike user_feed* | Select TaskPath, TaskName,State,Author,@{Name="Run_As";Expression={$_.Principal | Select -expandproperty UserID}},@{Name="Script_Path";Expression={(($_.Actions | Select -expandproperty Arguments) -replace '-executionpolicy unrestricted -file ') -replace '-file '}}


#Display the Task Info

       $Tasks
        

Goal 2: For each script, perform a search to find a specific value. If the value is found, record it in $Results

#Identify Script Locations
        $scripts = @()
        $scripts = $Tasks.Script_Path       
        

#Find the value in each script and record it in $Results

        $str = "ExServer1"
        $results = @()
        $Scripts | %{
            $fn = $_
            $str | %{
                $s = $_
                $D = get-content $fn | Select-String $s
                If($D -ne $Null){
                    Write-Host "
                    Found String in File:  $fn" -ForegroundColor Cyan
                    $results += $fn
                    } #ENdIF
            }##end $Str loop
 }#End get-childitem loop



#Display the results
     $Results

Scenario: We just discovered that our Exchange Online Mangement tools were no longer connecting. When we would run connect-exchangeonline we would receive an error message stating something similar to: ResourceUnavailable: (:) [New-ExoPSSession]

After investigation, we saw that the ExchangeOnlineManagment module was an older module, so we decided to try to update the module. When we ran this command Update-Module ExchangeOnlineManagment we ran into this Error:

PackageManagement\Install-Package : Unable to find repository ‘https://www.powershellgallery.com/api/v2’. Use Get-PSRepository to see all available repositories.

Solution: In order to fix this, I had to register and trust the PSGallery repository, and then I was successful with funning this module:

[Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12

Register-PSRepository -Default -Verbose

Set-PSRepository -Name "PSGallery" -InstallationPolicy Trusted

Update-Module ExchangeOnlineManagement

Scenario: Messages are getting deferred in Exchange Online when trying to send to our newly added Hybrid Exchange On-Premises servers. When investigating, we receive UntrustedRoot in the details of the connection error.

Cause/Solution: Although the new Hybrid Exchange On-Premises servers have the correct Exchange Certificate installed, we still needed to add the TLSCertificateName AND the TLSDomainCapabilities values into the Front-End Connector for each of the new servers.

For Troubleshooting purposes, here is what we did:

1. Ran the Get-exchangecertificate on each server and verified that SMTP was associated with the correct third-party certificate. It is represented with an S (for smtp) in the services.

2. Ran the Get-transportservice to verify the InternalTransportCertificateThumbprint is the correct thumbprint of the cert that we verified in step 1.

3. Ran the Get-ReceiveConnector on the received connector that should be receiving SMTP connections from Exchange Online (For us it was the default front end). THIS WAS OUR SOLUTION: We had to set the TLSCertificateName AND TLSDomainCapabilities properties on this receive connector:

TLSCertificateName = “CN=<cert identifiable value”
TLSDomainCapabilities = “mail.protection.outlook.com:AcceptCloudServicesMail”

Scenario: You are running a get-mailbox command and you want to remove a specific array value for reporting purposes, in our case it was a InPlaceHolds value, from any mailbox where this value exists. Example: We want to remove this Hold GUID from the report for visibility to not confuse folks when they see it for each mailbox: mbxf246564cda4f41faae611cb6e6198a2f:2

Scriptlet: Here is how we did that.

#0. Collect all Mailboxes via Get-Mailbox
$AllMBX += get-exomailbox -Properties alias,LitigationHoldEnabled,InPlaceHolds,recipienttypedetails -ResultSize unlimited 



#1. Loop through AllMbx and remove the value that we do not want
$Allmbx | Where InPlaceHolds -ne $null | %{
            "$_.Name"
            $IPH = $_.InPlaceHolds
            $IPH.Remove("mbxf246564cda4f41faae611cb6e6198a2f:2") 
            }



#2. Now, when you display $allMbx, you will see that this value no longer exists for the dataset
$AllMbx  | Select Alias, InPlaceHolds