param( [Parameter(Position=0, Mandatory=$true)] $To, [Parameter(Position=1, Mandatory=$true)] $From, [Parameter(Position=2, Mandatory=$true)] $SmtpServer ) function New-AuditLogReport { [CmdletBinding()] param( [Parameter(Position=0, Mandatory=$true, ValueFromPipeline=$true)] [Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEvent] $AuditLogEntry ) begin { $css = @' '@ $sb = New-Object System.Text.StringBuilder [void]$sb.AppendLine($css) [void]$sb.AppendLine("") [void]$sb.AppendLine("") [void]$sb.AppendLine("") [void]$sb.AppendLine("") [void]$sb.AppendLine("") [void]$sb.AppendLine("") [void]$sb.AppendLine("") [void]$sb.AppendLine("") [void]$sb.AppendLine("") [void]$sb.AppendLine("") } process { [void]$sb.AppendLine("") [void]$sb.AppendLine("") [void]$sb.AppendLine("") [void]$sb.AppendLine("") [void]$sb.AppendLine("") $cmdletparameters += $AuditLogEntry.cmdletparameters | %{ "$($_.name) : $($_.value)
" } [void]$sb.AppendLine("") [void]$sb.AppendLine("") [void]$sb.AppendLine("") $cmdletparameters = $null } end { [void]$sb.AppendLine("
Exchange 2010 Administrator Audit Log Report for $((get-date).ToShortDateString())
CallerRun DateSucceededCmdletParametersObject Modified
$($AuditLogEntry.Caller.split("/")[-1])$($AuditLogEntry.RunDate.ToString())$($AuditLogEntry.Succeeded)$($AuditLogEntry.cmdletname)$cmdletparameters$($AuditLogEntry.ObjectModified)
") Write-Output $sb.ToString() } } Send-MailMessage -To $To ` -From $From ` -Subject "Exchange Audit Log Report for $((get-date).ToShortDateString())" ` -Body (Search-AdminAuditLog -StartDate ((Get-Date).AddHours(-24)) -EndDate (Get-Date) | New-AuditLogReport) ` -SmtpServer $SmtpServer ` -BodyAsHtml