private void ResolveDisplayNames(MailboxAuditLogEvent auditRecord)
{
if (!string.IsNullOrEmpty(auditRecord.LogonUserSid) && string.IsNullOrEmpty(auditRecord.LogonUserDisplayName))
{
auditRecord.LogonUserDisplayName = this.GetDisplayNameFromSid(auditRecord.LogonUserSid);
}
}
private MailboxAuditLogRecord ReadAuditLogRecord(ObjectId itemId, ExDateTime creationTime, string content)
{
MailboxAuditLogRecordId identity = new MailboxAuditLogRecordId(itemId);
string mailboxResolvedName = MailboxAuditLogSearchWorker.ResolveMailboxOwnerName(this.mailboxUser);
MailboxAuditLogEvent mailboxAuditLogEvent = AuditLogParseSerialize.ParseMailboxAuditRecord(identity, content, mailboxResolvedName, this.mailboxUser.Guid.ToString(), new DateTime?(creationTime.UniversalTime.ToLocalTime()));
this.ResolveDisplayNames(mailboxAuditLogEvent);
return(mailboxAuditLogEvent);
}
public static MailboxAuditLogEvent ParseMailboxAuditRecord(MailboxAuditLogRecordId identity, string eventLog, string mailboxResolvedName, string guid, DateTime?lastAccessed)
{
MailboxAuditLogEvent mailboxAuditLogEvent = new MailboxAuditLogEvent(identity, mailboxResolvedName, guid, lastAccessed);
using (StringReader stringReader = new StringReader(eventLog))
{
PropertyParseSchema[] array = AuditLogParseSerialize.MailboxAuditLogRecordParseSchema;
string[] array2 = new string[2];
string text;
while ((text = stringReader.ReadLine()) != null)
{
if (text.Contains(".SourceItemId"))
{
MultiValuedProperty <MailboxAuditLogSourceItem> multiValuedProperty = mailboxAuditLogEvent[MailboxAuditLogEventSchema.SourceItems] as MultiValuedProperty <MailboxAuditLogSourceItem>;
string itemId = text.Substring(text.IndexOf(":") + 1).Trim();
if ((text = stringReader.ReadLine()) == null)
{
MailboxAuditLogSourceItem item = MailboxAuditLogSourceItem.Parse(itemId, null, null);
multiValuedProperty.Add(item);
break;
}
array2[0] = text;
text = stringReader.ReadLine();
array2[1] = text;
string itemSubject = null;
string itemFolderPathName = null;
foreach (string text2 in array2)
{
if (text2 == null)
{
break;
}
if (text2.Contains(".SourceItemSubject"))
{
itemSubject = text2.Substring(text2.IndexOf(":") + 1).Trim();
}
if (text2.Contains(".SourceItemFolderPathName"))
{
itemFolderPathName = text2.Substring(text2.IndexOf(":") + 1).Trim();
}
}
MailboxAuditLogSourceItem item2 = MailboxAuditLogSourceItem.Parse(itemId, itemSubject, itemFolderPathName);
((MultiValuedProperty <MailboxAuditLogSourceItem>)mailboxAuditLogEvent[MailboxAuditLogEventSchema.SourceItems]).Add(item2);
if (text == null)
{
break;
}
}
else if (text.Contains(".SourceFolderId"))
{
MultiValuedProperty <MailboxAuditLogSourceFolder> multiValuedProperty2 = mailboxAuditLogEvent[MailboxAuditLogEventSchema.SourceFolders] as MultiValuedProperty <MailboxAuditLogSourceFolder>;
string folderId = text.Substring(text.IndexOf(":") + 1).Trim();
if ((text = stringReader.ReadLine()) == null)
{
MailboxAuditLogSourceFolder item3 = MailboxAuditLogSourceFolder.Parse(folderId, null);
multiValuedProperty2.Add(item3);
break;
}
string folderPathName = text.Substring(text.IndexOf(":") + 1).Trim();
MailboxAuditLogSourceFolder item4 = MailboxAuditLogSourceFolder.Parse(folderId, folderPathName);
multiValuedProperty2.Add(item4);
}
else
{
PropertyParseSchema[] array4 = array;
int j = 0;
while (j < array4.Length)
{
PropertyParseSchema propertyParseSchema = array4[j];
if (text.StartsWith(propertyParseSchema.Label, StringComparison.OrdinalIgnoreCase) && text[propertyParseSchema.Label.Length] == ':')
{
object obj = propertyParseSchema.PropertyParser(text.Substring(propertyParseSchema.Label.Length + 1).Trim());
if (obj != null)
{
mailboxAuditLogEvent[propertyParseSchema.Property] = obj;
break;
}
break;
}
else
{
j++;
}
}
}
}
}
return(mailboxAuditLogEvent);
}
public NonOwnerAccessDetailRow(MailboxAuditLogEvent logEvent) : base(logEvent)
{
this.MailboxAuditLogEvent = logEvent;
}
internal NonOwnerAccessDetailRow(Identity id, MailboxAuditLogEvent searchResult) : base(id, searchResult)
{
this.MailboxAuditLogEvent = searchResult;
}
protected override void RenderChanges()
{
PowerShellResults <NonOwnerAccessDetailRow> powerShellResults = base.Results as PowerShellResults <NonOwnerAccessDetailRow>;
if (powerShellResults != null && powerShellResults.Output.Length > 0 && powerShellResults.Succeeded)
{
Table table = new Table();
table.CssClass = "PropertyForm";
int num = 0;
while (num < powerShellResults.Output.Length && num < 500)
{
NonOwnerAccessDetailRow nonOwnerAccessDetailRow = powerShellResults.Output[num];
MailboxAuditLogEvent mailboxAuditLogEvent = nonOwnerAccessDetailRow.MailboxAuditLogEvent;
table.Rows.Add(base.GetDetailRowForTable(Strings.TimeOfOperation, mailboxAuditLogEvent.LastAccessed.Value.ToUniversalTime().UtcToUserDateTimeString()));
table.Rows.Add(base.GetDetailRowForTable(Strings.OperationPerformedBy, mailboxAuditLogEvent.LogonUserDisplayName));
table.Rows.Add(base.GetDetailRowForTable(Strings.LogonType, this.GetLocalizedLogonType(mailboxAuditLogEvent.LogonType)));
table.Rows.Add(base.GetDetailRowForTable(Strings.OperationType, this.GetLocalizedAction(mailboxAuditLogEvent.Operation)));
if (mailboxAuditLogEvent.Operation.Equals(Enum.GetName(typeof(MailboxAuditOperations), MailboxAuditOperations.Move), StringComparison.InvariantCultureIgnoreCase) || mailboxAuditLogEvent.Operation.Equals(Enum.GetName(typeof(MailboxAuditOperations), MailboxAuditOperations.MoveToDeletedItems), StringComparison.InvariantCultureIgnoreCase) || mailboxAuditLogEvent.Operation.Equals(Enum.GetName(typeof(MailboxAuditOperations), MailboxAuditOperations.SoftDelete), StringComparison.InvariantCultureIgnoreCase) || mailboxAuditLogEvent.Operation.Equals(Enum.GetName(typeof(MailboxAuditOperations), MailboxAuditOperations.HardDelete), StringComparison.InvariantCultureIgnoreCase))
{
List <string> list = new List <string>();
List <string> list2 = new List <string>();
if (mailboxAuditLogEvent.SourceFolders.Added.Length > 0)
{
foreach (MailboxAuditLogSourceFolder mailboxAuditLogSourceFolder in mailboxAuditLogEvent.SourceFolders.Added)
{
if (!list2.Contains(this.FixFolderPathName(mailboxAuditLogSourceFolder.SourceFolderPathName)))
{
list.Add(this.FixFolderPathName(mailboxAuditLogSourceFolder.SourceFolderPathName));
}
}
list2.Add(this.FixFolderPathName(mailboxAuditLogEvent.FolderPathName));
}
else
{
foreach (MailboxAuditLogSourceItem mailboxAuditLogSourceItem in mailboxAuditLogEvent.SourceItems.Added)
{
list.Add(mailboxAuditLogSourceItem.SourceItemSubject);
list2.Add(this.FixFolderPathName(mailboxAuditLogSourceItem.SourceItemFolderPathName));
}
}
string information = string.Join(Strings.Separator, list.ToArray());
string information2 = string.Join(Strings.Separator, list2.ToArray());
table.Rows.Add(base.GetDetailRowForTable(Strings.ItemSubject, information));
table.Rows.Add(base.GetDetailRowForTable(Strings.SourceFolder, information2));
if (mailboxAuditLogEvent.Operation.Equals(Enum.GetName(typeof(MailboxAuditOperations), MailboxAuditOperations.Move), StringComparison.InvariantCultureIgnoreCase))
{
string information3 = this.FixFolderPathName(mailboxAuditLogEvent.DestFolderPathName);
table.Rows.Add(base.GetDetailRowForTable(Strings.DestinationFolder, information3));
}
}
else if (mailboxAuditLogEvent.Operation.Equals(Enum.GetName(typeof(MailboxAuditOperations), MailboxAuditOperations.FolderBind), StringComparison.InvariantCultureIgnoreCase))
{
table.Rows.Add(base.GetDetailRowForTable(Strings.FolderName, this.FixFolderPathName(mailboxAuditLogEvent.FolderPathName)));
}
else
{
table.Rows.Add(base.GetDetailRowForTable(Strings.ItemSubject, mailboxAuditLogEvent.ItemSubject));
if (mailboxAuditLogEvent.Operation.Equals(Enum.GetName(typeof(MailboxAuditOperations), MailboxAuditOperations.Create), StringComparison.InvariantCultureIgnoreCase))
{
table.Rows.Add(base.GetDetailRowForTable(Strings.FolderName, this.FixFolderPathName(mailboxAuditLogEvent.FolderPathName)));
}
}
table.Rows.Add(base.GetDetailRowForTable(Strings.OperationStatus, this.GetLocalizedStatus(mailboxAuditLogEvent.OperationResult)));
table.Rows.Add(base.GetEmptyRowForTable());
num++;
}
this.detailsPane.Controls.Add(table);
}
}
