When someone is missing a DL and we need to verify when it happened and who made the change (modify or delete), this script can help a lot!
It can return up to 5,000 records and data up to 365 days old. 🙂
$Command = @(‚Remove-DistributionGroup‘)
$results = Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-365) -EndDate (Get-Date).AddDays(1) -Operations $operations -SessionCommand ReturnLargeSet -ResultSize 5000
$data = @()
foreach ($line in $results ) {
$content = New-Object -TypeName PSObject
$Converteddata = convertfrom-json $line.AuditData
$content| Add-Member -MemberType NoteProperty -Name CreationTime -Value $line.CreationDate
$content | Add-Member -MemberType NoteProperty -Name Operation -Value $Converteddata.Operation
$content | Add-Member -MemberType NoteProperty -Name GroupOjectID -Value $Converteddata.ObjectId
$content| Add-Member -MemberType NoteProperty -Name ResponsibleUser -Value $Converteddata.UserID
$data += $content
}
$Data | Select CreationTime, Operation, GroupOjectID,ResponsibleUser
