How To Audit Exchange 2007 Mailbox Moves using PowerShell

I was recently asked generate a report that would detail when and who were moving mailboxes in an organization running Exchange 2007. The first option that popped into my head was diagnostic logging, but unfortunately, even when using expert level logging, the events do not provide the name of the user who performed the mailbox move. My next best option was to use the migration logs.

So, what are migration logs? When you use the Move-Mailbox cmdlet to move a mailbox, an XML report file is generated that contains the details of the mailbox move. By default, all of these XML log files are stored in C:\Program Files\Microsoft\Exchange Server\Logging\MigrationLogs or under \Logging\MigrationLogs in your $exinstall path. In order to audit these mailbox moves, we can parse the XML files using PowerShell to grab the details we need.

The following function, Get-MailboxMoveReport, accepts three parameters; Server, Mailbox and Path. Provide the server name using the Server parameter and the local directory containing the XML report files to the Path parameter. If you want to get a report for a specific mailbox, you can provide the name using the Mailbox parameter. If no values are provided for the Server and Path parameters, the function will run against the local server and check the default MigrationLogs location for XML report files.

Function Get-MailboxMoveReport {
    [CmdletBinding()]
    param(
        [Parameter(Position=0, Mandatory=$false)]
        [String]
        $Mailbox,
        [Parameter(Position=1, Mandatory=$false)]
        [String]
        $Server = $env:COMPUTERNAME,
        [Parameter(Position=2, Mandatory=$false)]
        [String]
        $Path = (Join-Path -Path $exinstall -ChildPath "Logging\MigrationLogs")
        )

    process {
        $report = @()
        $path = Join-Path "\\$server" $path.replace(":","$")
        foreach ($item in gci $path *.xml) {
            $report += [xml](Get-Content $item.fullname)
        }        

        $report | %{
            $MovedBy = $_."move-Mailbox".TaskHeader.RunningAs
            $StartTime = $_."move-Mailbox".TaskHeader.StartTime
            $EndTime = $_."move-Mailbox".TaskFooter.EndTime

            $result = $_."move-mailbox".taskdetails.item | %{
                New-Object PSObject -Property @{
                    Mailbox = $_.MailboxName
                    MovedBy = $MovedBy
                    MailboxSize = $_.MailboxSize
                    StartTime = $StartTime
                    EndTime = $EndTime
                    IsWarning = $_.result.IsWarning
                    ErrorCode = $_.result.ErrorCode
                }
            }
        }

        if($Mailbox) {
            $result | ?{$_.Mailbox -eq (Get-Mailbox $Mailbox).DisplayName}
        }
        else {
            $result
        }
    }
}

Here's a screen shot running the above function:

As you can see, the output provides a lot of detail including the status of the mailbox move, the start and end time, the size of the mailbox, and the user that performed the move.

Keep in mind that the Move-Mailbox cmdlet has a ReportFile parameter that can be used to store the XML report file in a specified folder other than the default. So, the report files you need may not always be in the migration logs folder depending on how the moves are being done. The function provides the Path parameter to specify an alternate directory, if needed.

This function is written with PowerShell v2, so you'll need to be running Exchange 2007 SP2 and PowerShell v2 in order to use it.

Related Posts

• What’s New in Administrator Audit Logging in Exchange 2010 SP1 Beta? (2)
• Restoring Mailbox Data from a Recovery Database in Exchange 2010 SP1 (13)
• Administrator Audit Log Reports in HTML Format – Exchange 2010 SP1 (36)
• Managing Disconnected Exchange Mailboxes with PowerShell (35)
• Generating Test Email Data for Exchange Labs with PowerShell (42)

Tagged as: audit, Auditing, EMS, Exchange, Mailbox, move, PowerShell