Skip to content

Commit c63e035

Browse files
12Knocksinna12Knocksinna
authored
Merge pull request #3 from 12Knocksinna/Development
Development
2 parents 6b183b8 + 4b672b0 commit c63e035

4 files changed

Lines changed: 166 additions & 68 deletions

File tree

‎FindInactiveDLs.PS1‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# FindInactiveDls
2+
# Find inactive distribution lists based on the message trace informnation, which means we can only go back 7 days...
3+
#
4+
$EndDate = Get-Date
5+
$StartDate = $EndDate.AddDays(-10)
6+
$Messages = $null
7+
$Page = 1
8+
Write-Host "Collecting message trace data for the last 10 days"
9+
Do
10+
{
11+
$CurrMessages = (Get-MessageTrace -Status Expanded -PageSize 5000 -Page $Page -StartDate $StartDate -EndDate $EndDate | Select Received, RecipientAddress)
12+
$Page++
13+
$Messages += $CurrMessages
14+
}
15+
Until ($CurrMessages -eq $Null)
16+
17+
$MessageTable = @{}
18+
$Messagetable = ($Messages | Sort RecipientAddress -Unique | Select RecipientAddress, Received)
19+
$DLs = Get-DistributionGroup -ResultSize Unlimited
20+
Write-Host "Processing" $DLs.Count "distribution lists..."
21+
$Results = ForEach ($DL in $DLs) {
22+
If ($MessageTable -Match $DL.PrimarySMTPAddress) {
23+
[pscustomobject]@{Name = $DL.DisplayName ; Active = "Yes"}
24+
Write-Host $DL.DisplayName "is active" -Foregroundcolor Yellow }
25+
Else {
26+
[pscustomobject]@{Name = $DL.DisplayName ; Active = "No"}
27+
Write-Host $DL.DisplayName "inactive" -Foregroundcolor Red }
28+
}
29+
30+
$Results | Export-CSV c:\Temp\ListofDLs.csv -NoTypeInformation
31+

‎LastLoggedInByExternalUsers.Ps1‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
# LastLoggedInByExternalUsers
2+
# Find the last time that external users (guest accounts) logged into our Office 365 tenant
3+
#
4+
5+
$Guests = (Get-AzureADUser -Filter "UserType eq 'Guest'" -All $True| Select Displayname, Mail, RefreshTokensValidFromDateTime | Sort RefreshTokensValidFromDateTime)
6+
Write-Host $Guests.Count "guest accounts found. Checking last connections..."
7+
$StartDate = (Get-Date).AddDays(-90)
8+
$StartDate2 = (Get-Date).AddDays(-10)
9+
$EndDate = (Get-Date).AddDays(+1)
10+
$Active = 0
11+
$EmailActive = 0
12+
$Inactive = 0
13+
$TeamsSpo = 0
14+
15+
ForEach ($G in $Guests) {
16+
Write-Host "Checking" $G.DisplayName
17+
$Recs = $Null
18+
$UserId = $G.Mail
19+
# Handle account whose guest invitation is not redeemed
20+
If ($Userid -eq $Null) {$UserId = "NullString"}
21+
$Recs = (Search-UnifiedAuditLog -UserIds $UserId -Operations UserLoggedIn, TeamsSessionStarted -StartDate $StartDate -EndDate $EndDate)
22+
If ($Recs -eq $Null) {
23+
Write-Host "No connections found in the last 90 days for" $G.DisplayName "created on" $G.RefreshTokensValidFromDateTime -Foregroundcolor Red
24+
# Check email tracking logs because guests might receive email from Groups. Account must be fully formed for the check. We can only go back 10 days
25+
If ($UserId -ne "NullString") {
26+
$EmailRecs = (Get-MessageTrace –StartDate $StartDate2 –EndDate $EndDate -Recipient $G.Mail)
27+
If ($EmailRecs.Count -gt 0) {
28+
Write-Host "Email traffic found for " $G.DisplayName "at" $EmailRecs[0].Received -foregroundcolor Yellow
29+
$Active++
30+
$EmailActive++ }}
31+
}
32+
Elseif ($Recs[0].CreationDate -ne $Null) {
33+
Write-Host "Last connection for" $G.DisplayName "on" $Recs[0].CreationDate "as" $Recs[0].Operations -Foregroundcolor Green
34+
$Active++
35+
$TeamsSpo++ }
36+
37+
}
38+
Write-Host ""
39+
Write-Host "Statistics"
40+
Write-Host "----------"
41+
Write-Host "Guest Accounts " $Guests.Count
42+
Write-Host "Active Guests " $Active
43+
Write-Host "Active on Teams and SPO " $TeamsSPO
44+
Write-Host "Active on Email " $EmailActive
45+
Write-Host "InActive Guests " ($Guests.Count - $Active)
46+
47+
48+
$Mbx = (Get-Mailbox -RecipientTypeDetails UserMailbox | Select PrimarySmtpAddress, DisplayName, UserPrincipalName)
49+
$StartCheckDate = (Get-Date).AddDays(-90)
50+
ForEach ($M in $Mbx) {
51+
$AuditRecs = (Search-UnifiedAuditLog -StartDate $StartCheckDate -EndDate (Get-Date) -UserIds $M.UserPrincipalName -Operations UserLoggedIn, MailboxLogin -SessionCommand ReturnNextPreviewPage )
52+
If ($AuditRecs.Count -gt 0) {
53+
Write-Host "Last Login date for" $M.DisplayName "is" $AuditRecs[0].CreationDate }
54+
Else {
55+
Write-Host "No logins found for" $M.DisplayName "since" $StartCheckDate }
56+
}

‎MFAReportMailboxes.ps1‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# MFAReportMailboxes.ps1
2+
# List mailboxes and the last time MFA processed each mailbox
3+
$Mbx = Get-Mailbox -RecipientTypeDetails UserMailbox -ResultSize Unlimited
4+
$Report = @()
5+
ForEach ($M in $Mbx) {
6+
$LastProcessed = $Null
7+
Write-Host "Processing" $M.DisplayName
8+
$Log = Export-MailboxDiagnosticLogs -Identity $M.Alias -ExtendedProperties
9+
$xml = [xml]($Log.MailboxLog)
10+
$LastProcessed = ($xml.Properties.MailboxTable.Property | ? {$_.Name -like "*ELCLastSuccessTimestamp*"}).Value
11+
$ItemsDeleted = $xml.Properties.MailboxTable.Property | ? {$_.Name -like "*ElcLastRunDeletedFromRootItemCount*"}
12+
If ($LastProcessed -eq $Null) {
13+
$LastProcessed = "Not processed"}
14+
$ReportLine = [PSCustomObject][Ordered]@{
15+
User = $M.DisplayName
16+
LastProcessed = $LastProcessed
17+
ItemsDeleted = $ItemsDeleted.Value}
18+
$Report += $ReportLine
19+
}
20+
$Report | Select User, LastProcessed, ItemsDeleted

‎SPOSitesRetention.ps1‎

Lines changed: 59 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -1,68 +1,59 @@
1-
# A script to display details of the retention policies applying to SharePoint and OneDrive for Business sites in an Office 365 tenant.
2-
# Uses the Security and Compliance Center PowerShell module
3-
4-
$Report = @()
5-
$RetentionPolicies = (Get-RetentionCompliancePolicy -ExcludeTeamsPolicy -DistributionDetail | ? {$_.SharePointLocation -ne $Null})
6-
# Now exclude all the retention policies that publish labels
7-
$Policies = @()
8-
ForEach ($P in $RetentionPolicies) {
9-
$Rule = Get-RetentionComplianceRule -Policy $P.Name
10-
If ([string]::IsNullOrWhiteSpace($Rule.RetentionDuration) -and [string]::IsNullOrWhiteSpace($Rule.ApplyComplianceTag)) {
11-
Write-Host "Policy" $P.Name "publishes retention labels to workloads - excluded from this report" }
12-
Else {
13-
$Policies += $P }
14-
}
15-
# Now we have a cleansed set of retention policies that apply to SharePoint
16-
ForEach ($P in $Policies) {
17-
$Duration = $Null
18-
Write-Host "Processing retention policy" $P.Name
19-
$Rule = Get-RetentionComplianceRule -Policy $P.Name
20-
$Settings = "Simple"
21-
$Duration = $Rule.RetentionDuration
22-
# Check whether a rule is for advanced settings - either a KQL query or sensitive data types
23-
If (-not [string]::IsNullOrWhiteSpace($Rule.ContentMatchQuery) -and -not [string]::IsNullOrWhiteSpace($Rule.ContentMatchQuery)) {
24-
$Settings = "Advanced/KQL" }
25-
Elseif (-not [string]::IsNullOrWhiteSpace($Rule.ContentContainsSensitiveInformation) -and -not [string]::IsNullOrWhiteSpace($Rule.ContentContainsSensitiveInformation)) {
26-
$Settings = "Advanced/Sensitive Data" }
27-
# Handle retention policy using advanced settings (keyword search or sensitive data type)
28-
If ($Rule.RetentionDuration -eq $Null -and $Rule.ApplyComplianceTag -ne $Null) {
29-
$Duration = (Get-ComplianceTag -Identity $Rule.ApplyComplianceTag | Select -Expandproperty RetentionDuration) }
30-
$RetentionAction = $Rule.RetentionComplianceAction
31-
If ([string]::IsNullOrEmpty($RetentionAction)) {
32-
$RetentionAction = "Retain" }
33-
If ($P.SharePointLocation.Name -eq "All") {
34-
$ReportLine = [PSCustomObject][Ordered]@{
35-
PolicyName = $P.Name
36-
SiteName = "All SharePoint Sites"
37-
SiteURL = "All SharePoint Sites"
38-
RetentionTime = $Rule.RetentionDurationDisplayHint
39-
RetentionDuration = $Duration
40-
RetentionAction = $RetentionAction
41-
Settings = $Settings}
42-
$Report += $ReportLine }
43-
If ($P.SharePointLocationException -ne $Null) {
44-
$Locations = ($P | Select -ExpandProperty SharePointLocationException)
45-
ForEach ($L in $Locations) {
46-
$Exception = "*Exclude* " + $L.DisplayName
47-
$ReportLine = [PSCustomObject][Ordered]@{
48-
PolicyName = $P.Name
49-
SiteName = $Exception
50-
SiteURL = $L.Name }
51-
$Report += $ReportLine }
52-
}
53-
ElseIf ($P.SharePointLocation.Name -ne "All") {
54-
$Locations = ($P | Select -ExpandProperty SharePointLocation)
55-
ForEach ($L in $Locations) {
56-
$ReportLine = [PSCustomObject][Ordered]@{
57-
PolicyName = $P.Name
58-
SiteName = $L.DisplayName
59-
SiteURL = $L.Name
60-
RetentionTime = $Rule.RetentionDurationDisplayHint
61-
RetentionDuration = $Duration
62-
RetentionAction = $RetentionAction
63-
Settings = $Settings}
64-
$Report += $ReportLine }
65-
}
66-
}
67-
$Report | Sort SiteName| Format-Table PolicyName, SiteName, RetentionDuration, RetentionAction, Settings -AutoSize
68-
1+
# A script to display details of the retention policies applying to SharePoint and OneDrive for Business sites in an Office 365 tenant.
2+
# Uses the Security and Compliance Center PowerShell module
3+
4+
$Report = @()
5+
# Fetch a set of retention policies that apply to SharePoint and aren't to publish labels
6+
$Policies = (Get-RetentionCompliancePolicy -ExcludeTeamsPolicy -DistributionDetail -RetentionRuleTypes | ? {$_.SharePointLocation -ne $Null -and $_.RetentionRuleTypes -ne "Publish"})
7+
ForEach ($P in $Policies) {
8+
$Duration = $Null
9+
Write-Host "Processing retention policy" $P.Name
10+
$Rule = Get-RetentionComplianceRule -Policy $P.Name
11+
$Settings = "Simple"
12+
$Duration = $Rule.RetentionDuration
13+
# Check whether a rule is for advanced settings - either a KQL query or sensitive data types
14+
If (-not [string]::IsNullOrWhiteSpace($Rule.ContentMatchQuery) -and -not [string]::IsNullOrWhiteSpace($Rule.ContentMatchQuery)) {
15+
$Settings = "Advanced/KQL" }
16+
Elseif (-not [string]::IsNullOrWhiteSpace($Rule.ContentContainsSensitiveInformation) -and -not [string]::IsNullOrWhiteSpace($Rule.ContentContainsSensitiveInformation)) {
17+
$Settings = "Advanced/Sensitive Data" }
18+
# Handle retention policy that simply retains and doesn't do anything else
19+
If ($Rule.RetentionDuration -eq $Null -and $Rule.ApplyComplianceTag -ne $Null) {
20+
$Duration = (Get-ComplianceTag -Identity $Rule.ApplyComplianceTag | Select -Expandproperty RetentionDuration) }
21+
$RetentionAction = $Rule.RetentionComplianceAction
22+
If ([string]::IsNullOrEmpty($RetentionAction)) {
23+
$RetentionAction = "Retain" }
24+
If ($P.SharePointLocation.Name -eq "All") {
25+
$ReportLine = [PSCustomObject][Ordered]@{
26+
PolicyName = $P.Name
27+
SiteName = "All SharePoint Sites"
28+
SiteURL = "All SharePoint Sites"
29+
RetentionTime = $Rule.RetentionDurationDisplayHint
30+
RetentionDuration = $Duration
31+
RetentionAction = $RetentionAction
32+
Settings = $Settings}
33+
$Report += $ReportLine }
34+
If ($P.SharePointLocationException -ne $Null) {
35+
$Locations = ($P | Select -ExpandProperty SharePointLocationException)
36+
ForEach ($L in $Locations) {
37+
$Exception = "*Exclude* " + $L.DisplayName
38+
$ReportLine = [PSCustomObject][Ordered]@{
39+
PolicyName = $P.Name
40+
SiteName = $Exception
41+
SiteURL = $L.Name }
42+
$Report += $ReportLine }
43+
}
44+
ElseIf ($P.SharePointLocation.Name -ne "All") {
45+
$Locations = ($P | Select -ExpandProperty SharePointLocation)
46+
ForEach ($L in $Locations) {
47+
$ReportLine = [PSCustomObject][Ordered]@{
48+
PolicyName = $P.Name
49+
SiteName = $L.DisplayName
50+
SiteURL = $L.Name
51+
RetentionTime = $Rule.RetentionDurationDisplayHint
52+
RetentionDuration = $Duration
53+
RetentionAction = $RetentionAction
54+
Settings = $Settings}
55+
$Report += $ReportLine }
56+
}
57+
}
58+
$Report | Sort SiteName| Format-Table PolicyName, SiteName, RetentionDuration, RetentionAction, Settings -AutoSize
59+

0 commit comments

Comments
 (0)