Tuesday, February 7, 2017

[Azure EMS] Get-AadrmUserLog - Azure Information Protection

When/Who/How accessed the file?


Get-AadrmUserLog

PS C:\Windows\system32> Get-AadrmUserLog -Path c:\temp  -fromdate 2/7/2017 –todate 2/10/2017
Acquiring access to your user log…
Downloading the log for 2017-02-06.
Downloading the log for 2017-02-07.
Downloaded the log for 2017-02-06. The log is available at c:\temp\rmslog-2017-02-06.log.
Downloaded the log for 2017-02-07. The log is available at c:\temp\rmslog-2017-02-07.log.
PS C:\Windows\system32>

Sample log

2017-02-07 03:49:26 omit Certify 'Success' -- '' '' - '' '' 'MSIPC;version=1.0.1903.0;AppName=WINWORD.EXE;AppVersion=16.0.4483.1000;AppArch=amd64;OSName=Windows;OSVersion=10.0.10586;OSArch=amd64' '' ''


Removed sensible texts..


1 comment:

  1. • Nice and good article. It is very useful for me to learn and understand easily. Thanks for sharing your valuable information and time. Please keep updatingAzure Online Training

    ReplyDelete