Admin AuditLogs

Question

Hi All

One of our shared mailbox is deleted from exchange online. I want to know who deleted the shared mailbox. will the below syntax fetch me the information

Search-AdminAuditLog -Resultsize unlimited -ExternalAccess $false -StartDate 01/10/2022 -EndDate 01/15/2022 | Export-Csv -Path C:\temp\logs.csv -NoTypeInformation

Answer 1

Hi @Roger Roger

The following commands should both work for you:

1) Search by cmdlet:

Search-AdminAuditLog -cmdlets Remove-Mailbox -StartDate 01/10/2022 -EndDate 01/15/2022 -IsSuccess $true | Export-Csv -Path C:\temp\logs.csv -NoTypeInformation  

2) Search by shared mailbox name:

Search-AdminAuditLog -objectIDs <shared mailbox name here> -StartDate 01/10/2022 -EndDate 01/15/2022 -IsSuccess $true | Export-Csv -Path C:\temp\logs.csv -NoTypeInformation  

Or you may add both parameters as filter:

Search-AdminAuditLog -cmdlets Remove-Mailbox -objectIDs <shared mailbox name here> -StartDate 01/10/2022 -EndDate 01/15/2022 -IsSuccess $true | Export-Csv -Path C:\temp\logs.csv -NoTypeInformation  

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

I'd suggest you also check for "Delete user." events, as the corresponding user object might have been deleted.

Search-UnifiedAuditLog -StartDate "01 Feb 2022" -EndDate "02 Feb 2022" -Operations "Delete user."

And, if you are using dirsync, make sure the change did not originate from on-premises, for example if the corresponding user object was excluded from the scope of dirsync, or deleted in AD.