Error when running the Script. about sparrow HOT 7 CLOSED

PSMailbox_Operations_Export.csv
ApplicationGraphPermissions.csv
Domain_List.csv

from sparrow.

Which 3 CSVs are being created?

from sparrow.

Interesting. The traceback makes it appear that the Search-UnifiedAuditLog cmdlet is not returning any data.

Can you try connecting to exchange online using powershell, then running:

[datetime] $StartDate = [DateTime]::UtcNow.AddYears(-1).AddMinutes(10)
[datetime] $EndDate = [DateTime]::UtcNow

$PSLoginData1 = Search-UnifiedAuditLog -StartDate $StartDate -EndDate $EndDate -ResultSize 5000  -FreeText "a0c73c16-a7e3-4564-9a95-2bdf47383716"

$PSLoginData1 

and see if any data is returned?

If no data is returned it could be indicative of a permissions issue and you will want to verify all permissions listed in the README.md are present.

from sparrow.

Interesting. The traceback makes it appear that the Search-UnifiedAuditLog cmdlet is not returning any data.

Can you try connecting to exchange online using powershell, then running:

[datetime] $StartDate = [DateTime]::UtcNow.AddYears(-1).AddMinutes(10)
[datetime] $EndDate = [DateTime]::UtcNow

$PSLoginData1 = Search-UnifiedAuditLog -StartDate $StartDate -EndDate $EndDate -ResultSize 5000  -FreeText "a0c73c16-a7e3-4564-9a95-2bdf47383716"

$PSLoginData1 

and see if any data is returned?

If no data is returned it could be indicative of a permissions issue and you will want to verify all permissions listed in the README.md are present.

You should be able to connect to exchange online with the cmdlet Connect-ExchangeOnline

from sparrow.

I'm getting data returned. I'm getting user log entries back from 5/20 to the present.

from sparrow.

Can you try running this command (connecting to exchange online with cmdlet Connect-ExchangeOnline):

[datetime] $StartDate = [DateTime]::UtcNow.AddYears(-1).AddMinutes(10)
[datetime] $EndDate = [DateTime]::UtcNow

$testData = Search-UnifiedAuditLog -StartDate $StartDate -EndDate $EndDate -ResultSize 5000 

$testData

This will give a more generic output of the data in your environment. If data returns, that's a good first step to rule out permission issues. If it returns data, please let us know how far back it was able to get.

After running the above command, please try running this one:

[datetime] $StartDate = [DateTime]::UtcNow.AddYears(-1).AddMinutes(10)
[datetime] $EndDate = [DateTime]::UtcNow

$ConsentData = Search-UnifiedAuditLog -StartDate $StartDate -EndDate $EndDate -RecordType AzureActiveDirectory -Operations "Add OAuth2PermissionGrant","Consent to application" -ResultSize 5000

$ConsentData

Does this return data?

You can also run the other queries like this as well if you wanted to check all the operations manually.

from sparrow.

I just went old school and rebooted the server and started the PS script over and it's working now. I now have CSV files all filled out.
Thank you for your time and Tshooting.

from sparrow.