Advertisement
codog180

Find all inbox rules created or changed in the past X days

Apr 14th, 2020
669
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. #As a part of determining if any of our 2000+ mailboxes have been phished, we've started scanning a report of any new or changed inbox rules.
  2.  
  3. $RuleLogs = Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-14) -EndDate (Get-Date) -Operations @('New-InboxRule', 'Set-InboxRule')
  4. [array]$entries = @()
  5. foreach ($entry in $RuleLogs)
  6.     {
  7.          $entry | Select CreationDate, UserIds, Operations, `
  8.          @{l  = 'Rule'; e = { (($entry.AuditData | ConvertFrom-Json).Parameters | ? { $_.Name -eq "Name" }).Value }}, `
  9.          @{ l = 'Description';  e = { (Get-InboxRule (($entry.AuditData | ConvertFrom-Json).Parameters | ? { $_.Name -eq "Name" }).Value -Mailbox $_.UserIds) | select -expandproperty description }} `
  10.          | Export-Csv c:\temp\14DayRules_Description.csv -append -notypeinformation
  11.     }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement