谁访问SharePoint网站的搜索，UnifiedAuditLog

我试着导出谁访问过我的集合中的不同SharePoint网站的用户的列表，请参阅用户。我已经试过，我可以得到它与内部用户的工作，但不能外用。谁访问SharePoint网站的搜索，UnifiedAuditLog

$startdate = "11/10/2017 8:00 AM" 
$enddate = "11/10/2017 9:00 AM" 
$userIDs = (import-csv C:\Junk\User.csv).Email 
foreach ($userid in $userids) { 
    $AuditlogMain = Search-UnifiedAuditLog -StartDate $startdate -EndDate $enddate -RecordType SharePoint -Operations PageViewed -UserIds $userID -ObjectIds "https://sitename.sharepoint.com/" -Formatted 
    $AuditlogMain.UserIDs | Select-object -Unique | Out-File C:\junk\Main.csv -Append 
}

我再拿到唯一的用户列表，但我想列出所有外部用户也和我不知道如何简单地从“@ .COM”邮件更改为_.com＃EXT＃ @ .onmicrosoft.com

还是有出口已访问网站的用户更简单的方法？如果你看$AuditlogMain.AuditData还有一些我想要的信息，但我不知道如何提取它。所以如果有人可以帮助我与外部用户或更好地帮助我从$AuditlogMain.AuditData提取ClientIP, ObjectId, UserId这将是有益的。

由于从文章提前

来源

2017-11-10 Andreas Andreasson

摘录提供：

$cred = Get-Credential 

$session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $cred -Authentication Basic -AllowRedirection 
Import-PSSession $session 
Connect-MsolService -Credential $cred 

$extUsers = Get-MsolUser | Where-Object {$_.UserPrincipalName -like "*#EXT#*" } 

$extUsers | ForEach { 
    $auditEventsForUser = Search-UnifiedAuditLog -EndDate $((Get-Date)) -StartDate $((Get-Date).AddDays(-7)) -UserIds $_.UserPrincipalName 

    Write-Host "Events for" $_.DisplayName "created at" $_.WhenCreated 

    $auditEventsForUser | FT 
} 

Remove-PSSession $session

下面是介绍如何获取审计信息的外部用户的文章： https://www.sharepointappie.nl/using-powershell-to-get-audit-data-for-external-users/

来源

2017-11-23 01:21:38

谁访问SharePoint网站的搜索，UnifiedAuditLog

回答

相关问题