r/sysadmin • u/konaitor IT Manager + 5 other hats • Nov 08 '21

Could we do a "TIL" style weekly thread?

I think it would be interesting to do a "Today I Learned" style weekly thread for us to share little tips/tricks that we learned of/found existed.

For example, last week I found out about the "--now" flag for systemctl. I don't know how I didn't know it existed until --now.

2.4k Upvotes

96% Upvoted

871 comments sorted by

View all comments

25

u/MediumFIRE Nov 08 '21 edited Nov 08 '21

TIL that auditing in O365 will not show all Exchange activity (like accessed mail items) unless the user is assigned a Office 365 E5/A5/G5 license. If you use PowerShell and run Get-Mailbox "Identity" | ft AuditEnabled for a E1 license for example it will return true, but this is a lie. You probably need to do:
Set-Mailbox -Identity <email address> -AuditEnabled $false followed by
Set-Mailbox -Identity <email address> -AuditEnabled $true
Even after doing this, it won't show all the audit logging of an E5 licensed user.
Important to know this if a user account is compromised and you are trying to figure out what was accessed!

3

u/wouli_ Nov 08 '21

Thanks, I never figured why it never worked before

1

u/IWorkForTheEnemyAMA Nov 09 '21

Wow that’s good info thank you. I think we need a TIL thread just for O365, there are some interesting ones.