Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Check-SharedMailboxes.PS1 #123

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Update Check-SharedMailboxes.PS1 #123

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 31 additions & 18 deletions Check-SharedMailboxes.PS1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,25 +30,38 @@ ForEach ($M in $Mbx) {
$UserId = $M.ExternalDirectoryObjectId
[array]$Logs = Get-MgAuditLogSignIn -Filter "userid eq '$UserId'" -All -Top 1
If ($Logs) {
$LogsFound = "Yes"
Write-Host ("Sign-in records found for shared mailbox {0}" -f $M.DisplayName) -ForegroundColor Red
# Check if the shared mailbox is licensed
$User = Get-MgUser -UserId $M.ExternalDirectoryObjectId -Property UserPrincipalName, AccountEnabled, Id, DisplayName, assignedPlans
[array]$ExoPlans = $User.AssignedPlans | Where-Object {$_.Service -eq 'exchange' -and $_.capabilityStatus -eq 'Enabled'}
If ($ExoServicePlan1 -in $ExoPlans.ServicePlanId) {
$ExoPlan1Found = $true

# Check if there are successful sign-in records (at least one), otherwise, don't keep track of them (these could be attack attempts)
Write-Output ("Checking for successful sign-in records for {0}" -f $M.DisplayName)
[array]$search4SuccessfulLogins = Get-MgAuditLogSignIn -Filter "userid eq '$UserId'" -All
$search4SuccessfulLogins | ForEach-Object {
If ($_.Status.ErrorCode -eq "0") {
$LogsFound = "Yes"
}
}

If ($LogsFound -eq "Yes") {
Write-Host ("Sign-in records found for shared mailbox {0}" -f $M.DisplayName) -ForegroundColor Red
# Check if the shared mailbox is licensed
$User = Get-MgUser -UserId $M.ExternalDirectoryObjectId -Property UserPrincipalName, AccountEnabled, Id, DisplayName, assignedPlans
[array]$ExoPlans = $User.AssignedPlans | Where-Object {$_.Service -eq 'exchange' -and $_.capabilityStatus -eq 'Enabled'}
If ($ExoServicePlan1 -in $ExoPlans.ServicePlanId) {
$ExoPlan1Found = $true

} ElseIf ($ExoServicePlan2 -in $ExoPlans.ServicePlanId) {
$ExoPlan2Found = $true
} ElseIf ($ExoServicePlan2 -in $ExoPlans.ServicePlanId) {
$ExoPlan2Found = $true
}

If ($ExoPlan1Found -eq $true) {
Write-Output ("Shared mailbox {0} has Exchange Online (Plan 1) license" -f $M.DisplayName)
} ElseIf ($ExoPlan2Found -eq $true) {
Write-Output ("Shared mailbox {0} has Exchange Online (Plan 2) license" -f $M.DisplayName)
} Else {
Write-Host ("Shared mailbox {0} has no Exchange Online license" -f $M.DisplayName) -ForegroundColor Yellow
}
} else {
Write-Host ("No successful sign-in records found for shared mailbox {0}" -f $M.DisplayName) -ForegroundColor Green
}

If ($ExoPlan1Found -eq $true) {
Write-Output ("Shared mailbox {0} has Exchange Online (Plan 1) license" -f $M.DisplayName)
} ElseIf ($ExoPlan2Found -eq $true) {
Write-Output ("Shared mailbox {0} has Exchange Online (Plan 2) license" -f $M.DisplayName)
} Else {
Write-Host ("Shared mailbox {0} has no Exchange Online license" -f $M.DisplayName) -ForegroundColor Yellow
}
}

$ReportLine = [PSCustomObject] @{
Expand All @@ -68,4 +81,4 @@ $Report | Out-GridView -Title "Shared Mailbox Sign-In Records and Licensing Stat
# https://office365itpros.com/office-365-github-repository/ for information about the scripts we write.

# Do not use our scripts in production until you are satisfied that the code meets the needs of your organization. Never run any code downloaded from the Internet without
# first validating the code in a non-production environment.
# first validating the code in a non-production environment.