You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The Search-MailboxAuditLog cmdlet performs a synchronous search of mailbox audit logs for one or more specified mailboxes and displays search results in the Exchange Management Shell window. To search mailbox audit logs for multiple mailboxes and have the results sent by email to specified recipients, use the New-MailboxAuditLogSearch cmdlet instead. To learn more about mailbox audit logging, see [Mailbox audit logging in Exchange Server](https://docs.microsoft.com/Exchange/policy-and-compliance/mailbox-audit-logging/mailbox-audit-logging).
58
58
59
+
This cmdlet is available in Office 365 operated by 21Vianet, but it won't return any results.
60
+
59
61
You need to be assigned permissions before you can run this cmdlet. Although this topic lists all parameters for the cmdlet, you may not have access to some parameters if they're not included in the permissions assigned to you. To find the permissions required to run any cmdlet or parameter in your organization, see [Find the permissions required to run any Exchange cmdlet](https://docs.microsoft.com/powershell/exchange/find-exchange-cmdlet-permissions).
Copy file name to clipboardExpand all lines: exchange/exchange-ps/exchange/Search-UnifiedAuditLog.md
+2Lines changed: 2 additions & 0 deletions
Original file line number
Diff line number
Diff line change
@@ -46,6 +46,8 @@ The Search-UnifiedAuditLog cmdlet is available in Exchange Online PowerShell. Yo
46
46
47
47
If you want to programmatically download data from the Microsoft 365 audit log, we recommend that you use the Microsoft 365 Management Activity API instead of using the Search-UnifiedAuditLog cmdlet in a PowerShell script. The Microsoft 365 Management Activity API is a REST web service that you can use to develop operations, security, and compliance monitoring solutions for your organization. For more information, see [Management Activity API reference](https://docs.microsoft.com/office/office-365-management-api/office-365-management-activity-api-reference).
48
48
49
+
This cmdlet is available in Office 365 operated by 21Vianet, but it won't return any results.
50
+
49
51
You need to be assigned permissions before you can run this cmdlet. Although this topic lists all parameters for the cmdlet, you may not have access to some parameters if they're not included in the permissions assigned to you. To find the permissions required to run any cmdlet or parameter in your organization, see [Find the permissions required to run any Exchange cmdlet](https://docs.microsoft.com/powershell/exchange/find-exchange-cmdlet-permissions).
The ExternalDsnReportingAuthority parameter specifies what the server name should be in the machine-readable part of the external DSN message. The default value is the authoritative domain specified during installation.
393
+
The ExternalDsnReportingAuthority parameter specifies the domain in the machine-readable part of external DSN messages. The default value is blank ($null), which means the value is the authoritative domain that you specified during the creation of the organization.
The ExternalDsnSendHtml parameter specifies whether external DSN messages should be sent by using HTML or whether messages should be sent in plain text. Valid input for this parameter is $true or $false.The default value is $true.
409
+
The ExternalDsnSendHtml parameter specifies whether external DSN messages should be HTML or plain text. Valid values are:
410
+
411
+
- $true: DSNs are HTML. This is the default value.
The ExternalPostmasterAddress parameter specifies the email address in the From header field of an external DSN message. The default value is $null. In the Transport service on a Mailbox server, the value of the external postmaster email address is postmaster@\<defaultaccepteddomain\>. If an Edge Transport server hasn't yet been through the EdgeSync process, and the ExternalPostmasterAddress parameter is set to $null, the external postmaster email address on the Edge Transport server is postmaster@\<edgetransportserverfqdn\>. If an Edge Transport server has completed the EdgeSync process, and the ExternalPostmasterAddress parameter is set to $null, the external postmaster email address on the Edge Transport server is postmaster@\<defaultaccepteddomain\>. To override the default behavior, you can specify an email address for the ExternalPostMasterAddress parameter.
428
+
The ExternalPostmasterAddress parameter specifies the email address in the From header field of an external DSN message. The default value is blank ($null).
429
+
430
+
The default value means the external postmaster address is postmaster@\<DefaultAcceptedDomain\> in the following locations:
431
+
432
+
- On Hub Transport servers or the Transport service on Mailbox servers.
433
+
- On Edge Transport servers that are subscribed to the Exchange organization.
434
+
- In Exchange Online.
435
+
436
+
On Edge Transport servers that aren't subscribed to the Exchange organization, the default external postmaster email address is postmaster@\<EdgeTransportServerFQDN\>.
437
+
438
+
To override the default behavior, you can specify an email address for the ExternalPostMasterAddress parameter.
426
439
427
440
```yaml
428
441
Type: SmtpAddress
@@ -463,15 +476,10 @@ On a Mailbox server, NDRs are copied to the mailbox assigned to the Exchange rec
463
476
DSN codes are entered as x.y.z and are separated by commas. By default, the following DSN codes are monitored:
464
477
465
478
- 5.4.8
466
-
467
479
- 5.4.6
468
-
469
480
- 5.4.4
470
-
471
481
- 5.2.4
472
-
473
482
- 5.2.0
474
-
475
483
- 5.1.4
476
484
477
485
To enter multiple values and overwrite any existing entries, use the following syntax: \<value1\>,\<value2\>,...\<valueN\>. If the values contain spaces or otherwise require quotation marks, you need to use the following syntax: "\<value1\>","\<value2\>",..."\<valueN\>".
The HeaderPromotionModeSetting parameter specifies whether named properties are created for custom X-headers on messages received from outside the Exchange organization. You can use one of the following values:
507
+
The HeaderPromotionModeSetting parameter specifies whether named properties are created for custom X-headers on messages received from outside the Exchange organization. Valid values are:
500
508
501
509
- MustCreate: Exchange creates a named property for each new custom X-header.
502
510
503
511
- MayCreate: Exchange creates a named property for each new custom X-header on messages received from authenticated senders. No named properties are created for custom X-headers on messages received from unauthenticated senders.
504
512
505
-
- NoCreate: Exchange won't create any named properties based on custom X-headers on incoming messages.
513
+
- NoCreate: Exchange won't create any named properties based on custom X-headers on incoming messages. This is the default value.
The InternalDsnReportingAuthority parameter specifies what the server name should be in the internal DSN message. The default value is the authoritative domain specified during installation.
609
+
The InternalDsnReportingAuthority parameter specifies the domain in the machine-readable part of internal DSN messages. The default value is blank ($null), which means the value is the authoritative domain that you specified during the creation of the organization.
The InternalDsnSendHtml parameter specifies whether internal DSN messages should be sent by using HTML or whether messages should be sent in plain text. Valid input for this parameter is $true or $false. The default is $true.
625
+
The InternalDsnSendHtml parameter specifies whether internal DSN messages should be HTML or plain text. Valid values are:
626
+
627
+
- $true: DSNs are HTML. This is the default value.
This parameter is available only in on-premises Exchange.
842
+
The MaxRecipientEnvelopeLimit parameter specifies the maximum number of recipients in a message. Exchange treats an unexpanded distribution group as one recipient.
832
843
833
-
The MaxRecipientEnvelopeLimit parameter specifies the maximum number of recipients in a message. The default value is 500. The valid input range for this parameter is from 0 through 2147483647. If you enter a value of Unlimited, no limit is imposed on the number of recipients in a message. Exchange treats an unexpanded distribution group as one recipient.
844
+
In on-premises Exchange, the default value is 500. The valid input range for this parameter is from 0 through 2147483647. If you enter a value of Unlimited, no limit is imposed on the number of recipients in a message.
845
+
846
+
In Exchange Online, the default value is Unlimited, which means the organizational limit of 1000 is used. You can enter a custom value up to 1000. For more information, see [Sending limits](https://docs.microsoft.com/office365/servicedescriptions/exchange-online-service-description/exchange-online-limits#sending-limits-1) in the Microsoft 365 service description.
834
847
835
848
```yaml
836
849
Type: Unlimited
837
850
Parameter Sets: (All)
838
851
Aliases:
839
-
Applicable: Exchange Server 2010, Exchange Server 2013, Exchange Server 2016, Exchange Server 2019
852
+
Applicable: Exchange Server 2010, Exchange Server 2013, Exchange Server 2016, Exchange Server 2019, Exchange Online
This parameter is available only in on-premises Exchange.
1376
+
This parameter is available or functional only in on-premises Exchange.
1364
1377
1365
1378
The VoicemailJournalingEnabled parameter specifies whether Unified Messaging voice mail messages are journaled by the Journaling agent. Valid input for this parameter is $true or $false. The default value is $true.
1366
1379
1367
1380
```yaml
1368
1381
Type: Boolean
1369
1382
Parameter Sets: (All)
1370
1383
Aliases:
1371
-
Applicable: Exchange Server 2010, Exchange Server 2013, Exchange Server 2016, Exchange Server 2019
1384
+
Applicable: Exchange Server 2010, Exchange Server 2013, Exchange Server 2016, Exchange Server 2019, Exchange Online
0 commit comments