This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(256, 54%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EVN%3C/text%3E%3C/svg%3E)
M365 environment, an admin assistant wants to know who and when an appointment from a shared calendar was deleted. The appointment is currently sitting in the recoverable deleted items folder of the mailbox (username is Calendar) hosting the calendar. We have Mailbox Auditing turned on. I was able to locate all of the delete actions using this PowerShell command which text searches for a shared calendar named COVERAGE:
Search-UnifiedAuditLog -ResultSize 5000 -StartDate "8/3/2022 00:00:00 AM" -EndDate "8/4/2022 00:00:00 PM" -Operations "HardDelete", "SoftDelete" -FreeText "\Calendar\Coverage"
There are two line items (rows) returned. One for a hard delete operation and the other a soft delete operation each with a different user ID associated. The results returned two unique identifiers for the appointment (AffectedItems and InternetMessageId).
AffectedItems:[{"Id":"RgAAAABhXYRdkXK4R6kuzEaMKL3bBwCiBA5RXWHLTaVY/RUqYr7TAAAAAcp6AADamOiVu/RvTLKprLfR7p44AACWLbGBAAAA"
InternetMessageId:"<SA2PR11MB49711ED559CDCF55866EF0BCD5B49@SA2PR11MB4971.namprd11.prod.outlook.com>"
If I use the appointment subject from the Search-UnifiedAuditLog results, I can run...
Search-Mailbox -Identity "CalendarUPN" -SearchQuery "Subject:SUBJECT TEXT" -TargetMailbox "MyUPN" -TargetFolder "Research" -LogLevel Full
...but the results returned are inaccurate in that the Item DocumentId does not match the AffectedItems value (or any other value) and simply shows who and when create the appointment.
I just want to know who last modified this appointment located in the recoverable deleted items folder. Is it possible?
Gratefully, Vinh.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(41.6, 80%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAL%3C/text%3E%3C/svg%3E)
Hi @Vinh Nguyen ,
If the audit log is enabled in your organization, you could try running it by simply selecting such user mailboxes and selecting All Activities to see if any relevant entries can be found. Please refer to the following link for the step-by-step information for running the audit log:
Search the audit log in the Microsoft Purview compliance portal - Microsoft Purview (compliance) | Microsoft Learn
Besides ,please run the Search-MailboxAuditLog command to see if you can found any related entries.
Search-MailboxAuditLog (ExchangePowerShell) | Microsoft Learn
Hi,
Just checking in to see how things are going on with this thread.
If the summary was helpful, you can click the "Accept Answer" button under this post so that other's with similar question can benefit from this thread as well. Thank you!
Hi @Vinh Nguyen ,
This was a much faster way to find what I was looking for .
Great to know that you've already thought of a solution and really appreciate it for your sharing!
By the way, since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others.". and according to the scenario introduced here: Answering your own questions on Microsoft Q&A, I would make a brief summary of this thread:
[Who Deleted an Appointment from a Shared Calendar]
Issue Symptom:
M365 environment, an admin assistant wants to know who and when an appointment from a shared calendar was deleted. The appointment is currently sitting in the recoverable deleted items folder of the mailbox (username is Calendar) hosting the calendar. We have Mailbox Auditing turned on.
I just want to know who last modified this appointment located in the recoverable deleted items folder. Is it possible?
The Solution:
This was a much faster way to find what I was looking for (who\what\when deleted an appointment from the shared calendar named Coverage)
PS C:\> Search-MailboxAuditLog -ShowDetails -StartDate 8/3/2022 -EndDate 8/4/2022 | Where-Object {($.Operation -like "*Delete") -and ($.FolderPathName -like "*Calendar\Coverage")} |Select-Object LogonUserDisplayName, Operation, FolderPathName, SourceItemSubjectsList, LastAccessed
LogonUserDisplayName : User's Display Name
Operation : SoftDelete
FolderPathName : \Calendar\Coverage
SourceItemSubjectsList : Appointment Subject
LastAccessed : 8/3/2022 8:55:18 AM
You could click the "Accept Answer" button for this summary to close this thread, and this can make it easier for other community member's to see the useful information when reading this thread. Thanks!
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(67.2, 15%, 16%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EM%3C/text%3E%3C/svg%3E)
That command doesn't work for me. I get the below error and get a similar error on $.FolderPathName:
Where-Object : The term '$.Operation' is not recognized as the name of a cmdlet, function, script file, or operable
program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:1 char:78
+ ... 4/19/2023 | Where-Object {($.Operation -like "*Delete") -and ($.Folde ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: ($.Operation:String) [Where-Object], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException,Microsoft.PowerShell.Commands.WhereObjectCommand
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(246.4, 16%, 33%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EHW%3C/text%3E%3C/svg%3E)
I am looking into using this but coming back with a few errors any ideas on how to fix.
Where-Object : The term '$.Operation' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:1 char:77
+ ... 9/9/2023 | Where-Object {($.Operation -like "*Delete") -and ($.Folde ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: ($.Operation:String) [Where-Object], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException,Microsoft.PowerShell.Commands.WhereObjectCommand
replace $.Operation by $_.Operation
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(204.8, 72%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJM%3C/text%3E%3C/svg%3E)
As Julien pointed out, the OP posted a correct response but because of the way this forum treats underscores as formatting commands, the underscores are missing in the posted text. The expression $_ refers to whatever has been passed via pipe to the current command, so you need to refer to its members as $_.Operation and $_ .FolderPathName. The full command would be as below. Note, also, that you can change the shared calendar name by putting a matching expression to compare with $_.FolderName. In my case, the calendar was for employees signing out, so I used "*Calendar\Sign*" as my match.
PS C:\> Search-MailboxAuditLog -ShowDetails -StartDate 8/3/2022 -EndDate 8/4/2022 | Where-Object {($_.Operation -like "*Delete") -and ($_.FolderPathName -like "*Calendar\Coverage")} |Select-Object LogonUserDisplayName, Operation, FolderPathName, SourceItemSubjectsList, LastAccessed
Thanks for the advice, Aholic. This was a much faster way to find what I was looking for (who\what\when deleted an appointment from the shared calendar named Coverage)
PS C:\> Search-MailboxAuditLog -ShowDetails -StartDate 8/3/2022 -EndDate 8/4/2022 | Where-Object {($.Operation -like "*Delete") -and ($.FolderPathName -like "*Calendar\Coverage")} |Select-Object LogonUserDisplayName, Operation, FolderPathName, SourceItemSubjectsList, LastAccessed
LogonUserDisplayName : User's Display Name
Operation : SoftDelete
FolderPathName : \Calendar\Coverage
SourceItemSubjectsList : Appointment Subject
LastAccessed : 8/3/2022 8:55:18 AM
Gratefully,
Vinh