谁访问SharePoint网站的搜索,UnifiedAuditLog
问题描述:
我试着导出谁访问过我的集合中的不同SharePoint网站的用户的列表,请参阅用户。我已经试过,我可以得到它与内部用户的工作,但不能外用。谁访问SharePoint网站的搜索,UnifiedAuditLog
$startdate = "11/10/2017 8:00 AM"
$enddate = "11/10/2017 9:00 AM"
$userIDs = (import-csv C:\Junk\User.csv).Email
foreach ($userid in $userids) {
$AuditlogMain = Search-UnifiedAuditLog -StartDate $startdate -EndDate $enddate -RecordType SharePoint -Operations PageViewed -UserIds $userID -ObjectIds "https://sitename.sharepoint.com/" -Formatted
$AuditlogMain.UserIDs | Select-object -Unique | Out-File C:\junk\Main.csv -Append
}
我再拿到唯一的用户列表,但我想列出所有外部用户也和我不知道如何简单地从“@ .COM”邮件更改为_.com#EXT# @ .onmicrosoft.com
还是有出口已访问网站的用户更简单的方法? 如果你看$AuditlogMain.AuditData
还有一些我想要的信息,但我不知道如何提取它。所以如果有人可以帮助我与外部用户或更好地帮助我从$AuditlogMain.AuditData
提取ClientIP, ObjectId, UserId
这将是有益的。
由于从文章提前
答
摘录提供:
$cred = Get-Credential
$session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $cred -Authentication Basic -AllowRedirection
Import-PSSession $session
Connect-MsolService -Credential $cred
$extUsers = Get-MsolUser | Where-Object {$_.UserPrincipalName -like "*#EXT#*" }
$extUsers | ForEach {
$auditEventsForUser = Search-UnifiedAuditLog -EndDate $((Get-Date)) -StartDate $((Get-Date).AddDays(-7)) -UserIds $_.UserPrincipalName
Write-Host "Events for" $_.DisplayName "created at" $_.WhenCreated
$auditEventsForUser | FT
}
Remove-PSSession $session
下面是介绍如何获取审计信息的外部用户的文章: https://www.sharepointappie.nl/using-powershell-to-get-audit-data-for-external-users/