document.write('\
\ "); document.write('
  1. ####### Log deletions in all sites in a web application ######
    2. \
  2.  
    3. \
  3. ############# http://iLoveSharePoint.com ##################
    4. \
  4. ############## by Christian Glessner ######################
    5. \
  5.  
    6. \
  6. ################ begin config #################
    7. \
  7.  
    8. \
  8. # Url of the web application to audit. Don\'t forget to activate the delete audit log on sites you want to log.
    9. \
  9. $targetWebAppUrl = "http://localhost:100"
    10. \
  10.  
    11. \
  11. # Url of the web that contains the list to log (list must contains the following columns: "Title" (text), "Event Url" (Url), "Item Type" (text), "Event" (text), "Occurred" (DateTime), "User" (text)"
    12. \
  12. $logWebUrl = "http://localhost:100"
    13. \
  13.  
    14. \
  14. # Title of the log list
    15. \
  15. $logListTitle ="Audit"
    16. \
  16.  
    17. \
  17. ################# end config ##################
    18. \
  18.  
    19. \
  19. $lastRunPropName = "_iLSP_lastAuditTimestamp"
    20. \
  20.  
    21. \
  21. [void][System.Reflection.Assembly]::LoadWithPartialName(\'Microsoft.SharePoint\')
    22. \
  22.  
    23. \
  23. $logSite = New-Object Microsoft.SharePoint.SPSite($logWebUrl)
    24. \
  24. $logWeb = $logSite.OpenWeb()
    25. \
  25. $logList = $logWeb.Lists[$logListTitle]
    26. \
  26.  
    27. \
  27. $targetWebApp = [Microsoft.SharePoint.Administration.SPWebApplication]::Lookup($(New-Object Uri($targetWebAppUrl)))
    28. \
  28.  
    29. \
  29. if($targetWebApp.Properties.ContainsKey($lastRunPropName) -eq $false)
    30. \
  30. {
    31. \
  31.         $targetWebApp.Properties[$lastRunPropName] = [DateTime]::MinValue
    32. \
  32.         $targetWebApp.Update()
    33. \
  33. }
    34. \
  34.  
    35. \
  35. $lastRun = [DateTime]::Parse($targetWebApp.Properties[$lastRunPropName].ToString())
    36. \
  36. $newRun = [DateTime]::Now.ToUniversalTime()
    37. \
  37.  
    38. \
  38. foreach($site in $targetWebApp.Sites)
    39. \
  39. {      
    40. \
  40.         $query = New-Object Microsoft.SharePoint.SPAuditQuery($site)
    41. \
  41.         $query.AddEventRestriction([Microsoft.SharePoint.SPAuditEventType]::Delete)
    42. \
  42.         $query.SetRangeStart($lastRun)
    43. \
  43.         $query.SetRangeEnd($newRun.AddDays(1))
    44. \
  44.        
    45. \
  45.         $result = $site.Audit.GetEntries($query)
    46. \
  46.        
    47. \
  47.         if($result.Count -gt 0)
    48. \
  48.         {
    49. \
  49.                 foreach($entry in $result)
    50. \
  50.                 {
    51. \
  51.                         $eventUrl = $site.Url + "/" + $entry.DocLocation
    52. \
  52.                        
    53. \
  53.                         $item = $logList.Items.Add()
    54. \
  54.                         $item[[Microsoft.SharePoint.SPBuiltInFieldId]::Title] = $entry.DocLocation
    55. \
  55.                         $item["Event Url"] = $eventUrl
    56. \
  56.                         $item["Item Type"] = $entry.ItemType
    57. \
  57.                         $item["Event"] = $entry.Event
    58. \
  58.                         $item["Occurred"] = $entry.Occurred.ToLocalTime()
    59. \
  59.                         $item["User"] = $logWeb.SiteUsers.GetByID($entry.UserId).LoginName
    60. \
  60.                         $item.Update()
    61. \
  61.                        
    62. \
  62.                 }
    63. \
  63.         }
    64. \
  64.        
    65. \
  65.         $site.Dispose()
    66. \
  66. }
    67. \
  67.  
    68. \
  68. $targetWebApp.Properties[$lastRunPropName] = $newRun
    69. \
  69. $targetWebApp.Update()
    70. \
  70.  
    71. \
  71. $logWeb.Dispose()
    72. \
  72. $logSite.Dispose()
    73. \
');document.write('
downloadThis Script brought to you by PoshCode\
\
\
');