I've always run the script below since exchange server 2013 and after applying the exchange server 2019 CU11 and exchange server 2016 CU22 updates I've been getting the error below. I tried in various ways to get around and was not successful in getting around this situation. Can someone help me please?
My error:
[PS] D:\AuditLogReport>.\AuditLogReport.ps1 -To [email protected] -From [email protected] -SmtpServer SRV001.myomain.local
New-AuditLogReport : The input object cannot be bound to any parameters for the command either because the command
does not take pipeline input or the input and its properties do not match any of the parameters that take pipeline
input.
At D:\AuditLogReport\AuditLogReport.ps1:72 char:107
... ((Get-Date).AddHours(-1)) -EndDate (Get-Date) | New-AuditLogReport) `
~~~~~~~~~~~~~~~~~~
CategoryInfo : InvalidArgument: (Microsoft.Excha...inAuditLogEvent:PSObject) [New-AuditLogReport], Para
meterBindingException
FullyQualifiedErrorId : InputObjectNotBound,New-AuditLogReport
param(
[Parameter(Position=0, Mandatory=$true)]
$To,
[Parameter(Position=1, Mandatory=$true)]
$From,
[Parameter(Position=2, Mandatory=$true)]
$SmtpServer
)
function New-AuditLogReport {
[CmdletBinding()]
param(
[Parameter(Position=0, Mandatory=$true, ValueFromPipeline=$true)]
[Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEvent]
$AuditLogEntry
)
begin {
$css = @'
<style type="text/css">
body { font-family: Tahoma, Geneva, Verdana, sans-serif;}
table {border-collapse: separate; background-color: #F2F2F2; border: 3px solid #103E69; caption-side: bottom;}
td { border:1px solid #103E69; margin: 3px; padding: 3px; vertical-align: top; background: #F2F2F2; color: #000;font-size: 12px;}
thead th {background: #903; color:#fefdcf; text-align: left; font-weight: bold; padding: 3px;border: 1px solid #990033;}
th {border:1px solid #CC9933; padding: 3px;}
tbody th:hover {background-color: #fefdcf;}
th a:link, th a:visited {color:#903; font-weight: normal; text-decoration: none; border-bottom:1px dotted #c93;}
caption {background: #903; color:#fcee9e; padding: 4px 0; text-align: center; width: 40%; font-weight: bold;}
tbody td a:link {color: #903;}
tbody td a:visited {color:#633;}
tbody td a:hover {color:#000; text-decoration: none;
}
</style>
'@
$sb = New-Object System.Text.StringBuilder
[void]$sb.AppendLine($css)
[void]$sb.AppendLine("<table cellspacing='0'>")
[void]$sb.AppendLine("<tr><td colspan='6'><strong>Hosted Exchange 2019 Administrator Audit Log Report for $((get-date).ToShortDateString())</strong></td></tr>")
[void]$sb.AppendLine("<tr>")
[void]$sb.AppendLine("<td><strong>Caller</strong></td>")
[void]$sb.AppendLine("<td><strong>Run Date</strong></td>")
[void]$sb.AppendLine("<td><strong>Succeeded</strong></td>")
[void]$sb.AppendLine("<td><strong>Cmdlet</strong></td>")
[void]$sb.AppendLine("<td><strong>Parameters</strong></td>")
[void]$sb.AppendLine("<td><strong>Object Modified</strong></td>")
[void]$sb.AppendLine("</tr>")
}
process {
[void]$sb.AppendLine("<tr>")
[void]$sb.AppendLine("<td>$($AuditLogEntry.Caller.split("/")[-1])</td>")
[void]$sb.AppendLine("<td>$($AuditLogEntry.RunDate.ToString())</td>")
[void]$sb.AppendLine("<td>$($AuditLogEntry.Succeeded)</td>")
[void]$sb.AppendLine("<td>$($AuditLogEntry.cmdletname)</td>")
$cmdletparameters = $AuditLogEntry.cmdletparameters | %{
"$($_.name) : $($_.value)<br>"
}
[void]$sb.AppendLine("<td>$cmdletparameters</td>")
[void]$sb.AppendLine("<td>$($AuditLogEntry.ObjectModified)</td>")
[void]$sb.AppendLine("</tr>")
$cmdletparameters = $null
}
end {
[void]$sb.AppendLine("</table>")
Write-Output $sb.ToString()
}
}
Send-MailMessage -To $To `
-From $From `
-Subject "Exchange Audit Log Report for $((get-date).ToShortDateString())" `
-Body (Search-AdminAuditLog -ResultSize 250000 -StartDate ((Get-Date).AddHours(-48)) -EndDate (Get-Date) | New-AuditLogReport) `
-SmtpServer $SmtpServer `
-BodyAsHtml
CodePudding user response：
The error message implies that the output from your Search-AdminAuditLog call is not of type [Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEvent] and also cannot be converted to it.
That is, your New-AuditLogReport function expects object of type [Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEvent] as pipeline input, but the actual pipeline is of a different, incompatible type.
Run the following to get the full type name(s) of the output objects output by your Search-AdminAuditLog call:
Search-AdminAuditLog -ResultSize 250000 -StartDate ((Get-Date).AddHours(-48)) -EndDate (Get-Date) |
Get-Member | ForEach-Object TypeName | Select-Object -Unique
Then adjust the $AuditLogEntry parameter declaration in your New-AuditLogReport function accordingly.
Here's a simple demonstration of the problem, which provokes the error you saw, because the input object isn't of the expected type ([datetime]) and cannot be converted to it:
"Definitely not a date." | & {
param(
[Parameter(ValueFromPipeline)]
[datetime] $Date
)
}
CodePudding user response：
Your observation is very important. This server the "TypeName" is correct and the script is working fine.
[PS] C:>Search-AdminAuditLog -ResultSize 250000 -StartDate ((Get-Date).AddHours(-1)) -EndDate (Get-Date) | Get-Member | ForEach-Object TypeName | Select-Object -Unique
Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEvent
Another Exchange server is different: <Deserialized.*>
Search-AdminAuditLog -ResultSize 250000 -StartDate ((Get-Date).AddHours(-1)) -EndDate (Get-Date) | Get-Member | ForEach-Object TypeName | Select-Object -Unique
Deserialized.Microsoft.Exchange.Management.SystemConfigurationTasks.AdminAuditLogEvent
How can I serialize again this AdminAuditLogEvent class Powershell?
