functions/User/Start-OspreyUserInvestigation.ps1
|
# String together the Osprey user functions to pull data for a single user Function Start-OspreyUserInvestigation { <# .SYNOPSIS Gathers common data about a provided user. .DESCRIPTION Runs all Osprey users related cmdlets against the specified user and gathers the data. Cmdlet Information Gathered ------------------------- ------------------------- Get-OspreyUserConfiguration Basic User information Get-OspreyUserInboxRule Searches the user for Inbox Rules Get-OspreyUserEmailForwarding Looks for email forwarding configured on the user Get-OspreyUserAutoReply Looks for enabled AutoReplyConfiguration Get-OspreyuserAuthHistory Searches the unified audit log for users logons Get-OspreyUserMailboxAuditing Searches the unified audit log for mailbox auditing information Get-OspreyUserAdminAudit Searches the EXO Audit logs for any commands that were run against the provided user object. Get-OspreyUserMessageTrace Pulls the email sent by the user in the last 7 days. .PARAMETER UserPrincipalName Single UPN of a user, comma separated list of UPNs, or array of objects that contain UPNs. .OUTPUTS See help from individual cmdlets for output list. All outputs are placed in the $Osprey.FilePath directory .EXAMPLE Start-OspreyUserInvestigation -UserPrincipalName bsmith@contoso.com Runs all Get-OspreyUser* cmdlets against the user with UPN bsmith@contoso.com .EXAMPLE Start-OspreyUserInvestigation -UserPrincipalName (get-mailbox -Filter {Customattribute1 -eq "C-level"}) Runs all Get-OspreyUser* cmdlets against all users who have "C-Level" set in CustomAttribute1 #> param ( [Parameter(Mandatory = $true)] [array]$UserPrincipalName ) Out-LogFile "Investigating Users" # Verify our UPN input [array]$UserArray = Test-UserObject -ToTest $UserPrincipalName foreach ($Object in $UserArray) { [string]$User = $Object.UserPrincipalName Out-LogFile "Running Get-OspreyUserConfiguration" -action Get-OspreyUserConfiguration -User $User Write-Host "------------------------------------------------" Out-LogFile "Running Get-OspreyUserInboxRule" -action Get-OspreyUserInboxRule -User $User Write-Host "------------------------------------------------" Out-LogFile "Running Get-OspreyUserEmailForwarding" -action Get-OspreyUserEmailForwarding -User $User Write-Host "------------------------------------------------" Out-LogFile "Running Get-OspreyUserAutoReply" -action Get-OspreyUserAutoReply -User $User Write-Host "------------------------------------------------" Out-LogFile "Running Get-OspreyUserAuthHistory" -action Get-OspreyUserAuthHistory -User $user -ResolveIPLocations Write-Host "------------------------------------------------" Out-LogFile "Running Get-OspreyUserEmailActivity" -action Get-OspreyUserEmailActivity -User $User Write-Host "------------------------------------------------" Out-LogFile "Running Get-OspreyUserMessageTrace" -action Get-OspreyUserMessageTrace -user $User Write-Host "------------------------------------------------" Out-LogFile "Running Get-OspreyUserDevices" -action Get-OspreyUserDevices -user $User Write-Host "------------------------------------------------" Out-LogFile "Running Get-OspreyUserFileAccess" -action Get-OspreyUserFileAccess -user $User Write-Host "------------------------------------------------" Out-LogFile "User investigation complete" } } |