diff --git a/Scripts/Get-UAL.ps1 b/Scripts/Get-UAL.ps1 index 0e43ec2..42f7d47 100644 --- a/Scripts/Get-UAL.ps1 +++ b/Scripts/Get-UAL.ps1 @@ -824,7 +824,6 @@ function Get-UALSpecificActivity } catch { write-logFile -Message "[INFO] Ensure you are connected to M365 by running the Connect-M365 command before executing this script" -Color "Yellow" - Write-logFile -Message "[ERROR] An error occurred: $($_.Exception.Message)" -Color "Red" throw } @@ -856,7 +855,7 @@ function Get-UALSpecificActivity [DateTime]$currentStart = $script:StartDate [DateTime]$currentEnd = $script:EndDate - $specificResult = Search-UnifiedAuditLog -StartDate $script:StartDate -EndDate $script:EndDate -Operations $record -UserIds $UserIds @baseSearchQuery -ResultSize 1 | Select-Object -First 1 -ExpandProperty ResultCount + $specificResult = Search-UnifiedAuditLog -StartDate $script:StartDate -EndDate $script:EndDate -Operations $record -UserIds $UserIds -ResultSize 1 | Select-Object -First 1 -ExpandProperty ResultCount if (($null -ne $specificResult) -and ($specificResult -ne 0)) { if ($OutputDir -eq "" ){ @@ -883,7 +882,7 @@ function Get-UALSpecificActivity while ($currentStart -lt $script:EndDate) { $currentEnd = $currentStart.AddMinutes($Interval) - $amountResults = Search-UnifiedAuditLog -UserIds $UserIds -StartDate $currentStart -EndDate $currentEnd -Operations $record @baseSearchQuery -ResultSize 1 | Select-Object -First 1 -ExpandProperty ResultCount + $amountResults = Search-UnifiedAuditLog -UserIds $UserIds -StartDate $currentStart -EndDate $currentEnd -Operations $record -ResultSize 1 | Select-Object -First 1 -ExpandProperty ResultCount if ($null -eq $amountResults) { @@ -893,7 +892,7 @@ function Get-UALSpecificActivity elseif ($amountResults -gt 5000) { while ($amountResults -gt 5000) { - $amountResults = Search-UnifiedAuditLog -StartDate $currentStart -EndDate $currentEnd -UserIds $UserIds -Operations $record @baseSearchQuery -ResultSize 1 | Select-Object -First 1 -ExpandProperty ResultCount + $amountResults = Search-UnifiedAuditLog -StartDate $currentStart -EndDate $currentEnd -UserIds $UserIds -Operations $record -ResultSize 1 | Select-Object -First 1 -ExpandProperty ResultCount if ($amountResults -lt 5000) { if ($Interval -eq 0) { Exit @@ -920,7 +919,7 @@ function Get-UALSpecificActivity $sessionID = $currentStart.ToString("yyyyMMddHHmmss") while ($true) { - [Array]$results = Search-UnifiedAuditLog -StartDate $currentStart -EndDate $currentEnd -UserIds $UserIds -Operations $record @baseSearchQuery -SessionCommand ReturnLargeSet -ResultSize $ResultSize + [Array]$results = Search-UnifiedAuditLog -StartDate $currentStart -EndDate $currentEnd -UserIds $UserIds -Operations $record -SessionCommand ReturnLargeSet -ResultSize $ResultSize $CurrentCount = 0 if ($null -eq $results -or $results.Count -eq 0) {