Onedrive activity log - how to address
How do I see OneDrive activity?
How to open the details pane. in the upper-right corner to open the details pane. If you don't have a file selected and you select Information, you'll see a summary of all the activities that have happened inside your OneDrive. Activities will show for the last 30 days only.
OneDrive is a great tool for collaborating on documents, projects, and other files.
With everything stored in the cloud, you don't have to send files back and forth via email. Instead, you can work on the exact same file with anyone you want; everything the other person needs is a Microsoft account. To get started, hover over the file or folder you want to share, then click the circle to select it.
Then click the Share ... command and OneDrive will open a pop-up window.
Here, you have several options to share your file. You can get a generic link to use and distribute however you want ... or you can email a link to the people you specify ... click the drop-down arrow here for more options to link to websites Facebook, Twitter, or LinkedIn… However, we recommend emailing the link unless you are sharing a document that you want a wider audience to see (such as a flyer or invitation ). the people you send an email to can edit it ie make changes, additions, and also leave comments - we'll see how that works in a moment.
If you don't want them to have editing rights, uncheck this box. Enter the email addresses of the people you want to share with. If they're on your contacts list, you'll be able to select them once you start typing.
Even people who don't use OneDrive can choose to send an email, but it won't. You can edit the file - you can only view it. Next, add a personal message if you want, and when you're ready, hit the Share button.
OneDrive will send an email to the people you specify, and you can always view or edit the file, depending on the permissions you've given them. Once the file has been shared, you can click this command in the top right corner to open the details pane on the right, which is where you can see the names of the people you've shared with. You can also change their permissions ... or remove them all at once.
When you're done, deactivate the file. You can also share an entire folder in OneDrive so everyone has access to what they need. Just follow the same steps as before.
But remember, when you share a folder, all files in that folder are shared too. You can't choose different settings for files within a folder. How does sharing work? Let's look at some of the ways you can do it.
You can work on a document with several people at the same time; this feature is great for work, school - even planning a potluck dinner, like in this example. OneDrive lets you know who's still working on the document with you, so you don't have to switch revisions back and forth. However, this aspect of Office Online can be temperamental; you may need to refresh and reopen the file to see recent changes; you can also leave comments on a document; B. to give someone feedback or to ask a question.
To add a comment, simply check the box for the file you want. Then look at the Comments section below in the details pane. When you're done, click Add.
Here you will also see comments from other people. Now that you know how it works, what would you like to share in Office Online? Maybe a Word document? A presentation? Try some of the features discussed over today and learn firsthand what OneDrive can do.
Does OneDrive log activity?
The User activity logs report shows you when users took different actions in OneDrive for work or school. Following are descriptions of the events recorded in your User activity logs report.
You ever have OneDrive syncing issues like these.
It's a common problem, along with a few other things that happen with OneDrive, and I'll show you how to fix it. Here are the steps I take to fix these common OneDrive sync issues. The first step - hover your mouse over it and see what it says.
Notice that Sync Files 1 Remaining appears. So there is one file that is having right click issues. If there is a problem with synchronization, you will be given a menu option 'View synchronization problems', which in this case is not there.
So we know we have a file, so all you have to do is look at that file and find out what's going on. In the menu, select Open your OneDrive for Business folder and look for an unchecked green check box in the list. You can see right here that this project folder is not properly synchronized.
Open it and look for the file that was not syncing and you can see here that this 2018 project list document file is not syncing. The quickest solution I usually do is to take this file and drag it to your desktop. Make sure it has been removed from the list.
OneDrive tries to sync the file again. Now take a look at your OneDrive and you will find that it no longer has any problems with syncing. In this situation we can drag this file back here and it will be re-synced and the issues are resolved.
Now when you find this file you will see that it has a green check mark on it. If you see View Sync Problem on your menu, it is usually because you have violated one of these file and folder restrictions. You cannot sync individual files over 15 GB.
The maximum file name is 400 characters. You cannot use any of these invalid characters. You cannot use these file names either.
And you can't use these names for folders. Also note that if you exceed 100,000 files, you will experience some serious sync performance issues and finally, OneDrive for Business limits each user to 1TB of total storage. If you've tried removing the file and restoring it back to the OneDrive location, and you've also fixed all of the view sync issues, but you're still having issues syncing to OneDrive, there is another option that I think works , the repair is your office installation.
Go to Control Panel, go to Programs and Features, find your Microsoft Office 365, click the Change button and do a quick repair. Click the Repair option to close all of your Microsoft Office applications and perform a repair. When the repair is done, check it out and see if it works.
Another thing to check that can affect synchronization is Windows updates. Make sure you don't have any pending updates or updates that require a reboot as shown here as this can disrupt the sync process. If you've exhausted other options and are still having problems with syncing, you may need to stop and run the sync process again, which I can show you here.
Right-click OneDrive, choose StopSyncing a Folder, click Stop Syncing, and click Yes. Click OK and the synchronization will stop. Now, before you sync again, it's a good idea to go to your C drive and look at your home folder and switch to your specific user account.
You'll notice that there are a OneDrive and OneDrive for Business out of sync changes, sometimes multiple. Look in there and see if there are any files that haven't been synced. If there aren't any, I prefer to actually remove these folders and have them re-created when I sync again.
You can also see your OneDrive file location and all of the folders. It can be beneficial to move these files out of the OneDrive sync location, run the sync so it's really quick, and then copy the files back when they're done. So I'm going to select all of the files, move them to my desktop, or some other location.
Now I right click on Sync New Library again and it should show the options to sync with your folder. Occasionally you won't see a location here and then you may have to go back and do the repair of your folder and install Office again before actually syncing, but in this case I'll sync now. It formally asks me for contact information.
I'll choose a work or school account and sign in just like I do in Office 365 and sign in. It will start syncing the files and you can click the button to see the location. You will notice that the green check mark is enabled for the folders that are being synced and a 1 is added to the end of the folder name to separate it from the original one I synced earlier.
You will notice that both are listed here. To see the status of the sync, you can go to the OneDrive and see that it has 161 left. Once that's done you should see the green check mark there and nothing left on your OneDrive sync.
Now you can compare the files here to the ones you moved from the old location if you just want to check that nothing is lost, and you can now delete the original OneDrive location as it's empty and no longer needed. Hopefully one of these solutions worked so that you can fix your OneDrive sync problems. If you have any problems please comment.
I am happy to answer any of your questions. Thank you for watching. Hey, if you want to see more articles like this please subscribe and if you liked this article click the thumbs up and leave a comment.
I really appreciate your support!
How do I access OneDrive logs?
In addition, we can also go to the Office 365 portal and click OneDrive to go to your OneDrive for Business library and go to Site settings > Storage Metrics under Site Collection Administration > Documents and click Last Modified column to get the Modified status about your sync library.
noticing the big wall of text on the screen so go ahead, open it all up, don't look at any other software because now you're learning part of the process of being a safety engineer in a company, know what to look for, right, there's no use thinking the hackers are among us if you don't know what to look for and the hackers are among you, that's the fun part, but you have to learn to hunt them down so hackers mainly use one web based scanner and an operating system scanner So there are two of these that you will actually play off and play with both.
The one we're going to be playing around with today is called Nets Parker, so in your 166 director you should see a program folder and in there you should see a program called nets Parkerall right, so nets Parker is just a web server scanner, right because the systems have gotten so complex that they didn't break the scan into any all-in-one tool and your book has a lot of different types of scanners in it and we'll play around with a few of them, or we'll go with Nets Parker for Web services messing around and we have two web servers up here that are the IP addresses of those who remember what the web servers are? 10 and 11 ok then we have a subdirectory called WP and the other has a subdirectory called Drupal which you can now find the vulnerable web services which will be pushed out when you start with that and we just take the logs from the Drupal Server that when you scan a web server you literally make a call for every single page on that web server, leaving you with a monster footprint. So if you go and direct this at anyone other than the victim machines over here, leave a monster footprint with Highline's IP on it to the right and if you leave something with Highline Community College's IP, they call college and say hey what's up and what? en somebody calls and says hey what's up and then he turns around and grabs network services and network services freak out goes ohmy god oh my god oh my god and then when the network services are done freak out they go up we have to talk to danright this is going to fall on me right away, which means I sing like a canary isqueal like a pig and I sing and dance properly, so under no circumstances does this tool target any computer system other than these two victim computers at 10:00 and 11:00 am because if you do don't let Danhave call it but again fine, really honest so leave a lot of things behind you. One of the things that Nets Parker does is that it tries to do something called cross-site scripting, and this is pretty classic cross-site scripting if your cross-site scripting is what you do trying to get the computer to do something it wasn't meant to do by giving it a lot of things it won't understand by now, I know you are not an HTML programmer I know you don't understand much, but cross-site scripting is one of the most popular vulnerabilities on the planet right now.
What happens right in the end is that when you script, when you do something you want to have a tag to open and close, all right, if you have this, this is your open day and this is your closed day, and then everything in here is whatever is running, so it's considered a script for a cross-site script. This thing we do is we open this line with a couple of undermined things, so that is a good shape this is a bad shape this will confuse the computer because it doesn't follow correct syntax in urls it doesn't follow correct syntax at all so the computer will go oh wait it's a style tag put on, wait, where is that open? the style tag and it will search everything to find the open script and if it can't find it it goes oh waitclosed script where the open script in the computer gets even more confused and then it can just go well, fine Everything is fine here so you can confuse computers computers get better programmers get better, but that's still pretty clunky and generally right I can't tell you the number of times we've gotten into other people's web servers for the only way little is-thing right here is style and script, so those two are absolutely devastating to get into a computer system and it's that simple, and if you go into ten eleven both are prone to various forms of cross-site scripting , everything okay, somehow neat, the other thing that ends? It also sometimes happens that it is encoded in what is known as hex, so the first percent 0d out here at w3 schools there are really good URL encodings, right a URL encoding is that there is a human-readable line with percent twenty, if You percent twenty see the computer running to understand that you will not do it unless you have memorized and this table is about 254 characters which I don't expect anyone who can remember today maybe tomorrow not today, but when you're running an application that generally doesn't require much url coding and you start to see a whole bunch of such things in your urls that instantly tell you that something is going wrong here or there ? something strange that someone does, something lazy and fishy behavior where the job is fun, now you have to go hunting them downright and hunting people can be a lot of fun so if you repeat things you are actually going to look up those Apache web server logs what we have and you actually get the apache web server logs from those two computers from last semester later, but these are the things you are leaving behind so it looks for vulnerabilities like leaving behind what tool is using one of the things about tools is that they leave their own fingerprints for someone to go over nets and use parkers against your website and you haven't specifically authorized them, at least you know which tool they used and that's a good thing because then you can go back and try running the same tool on your own website to see what rights they might have many of the commercial en tools always leave traces as to which software tool was actually used so you can just grab the tool and then see what they have Yes sir, is there any way not to leave a fingerprint? Tools Once you get into programming and start creating your own tools, there are ways to suppress things in the system so that it looks like normal traffic and you can upload your really bad Israeli country and western music and them then share it with everyone across the planet or use it as your seed farm for a BitTorrent server so there are certain tools you will see some activity but you won't know how to hit your server until you do See quite a bunch of badcountry music on your Amazon server cloud so there are tools out there to suppress it, huh yeah we ran an FTP server once and it's over and after about a hundred gigs of really bad Israeli country and western music and there's nothing wrong with this country and western music except for the Israeli accent trying to sing cowboy, and that was before the days of auto-tune Wiss en you, that was long before the days of auto-voting. All right, so when it goes through and does its job it is looking for a lot of stuff, if you see error codes correctly 404 is the best error code.
Just see if someone is scanning and why 404 is the best error code because the computer then tells the person doing the scan not found I can't process this because I don't have everything right so I have 404 absolutely good aircode If you're seeing this really bad error code, to see when you really see something, this is Code200 because that means, oh okay here, we're good, so you'll find it said on Aircode 200, okay, here go ahead with all that cross-site scripting now we know that there is some really cool cross-site scripting somewhere on this Drupal site that we can fix with this. Actually look at the logs if you see error code 200, that means it is a web server that said okay here. If you see 404 it means not found, if you see something in the 300 it means it was a redirect you just want to update everything that comes in from google or some other search engine.
You are sending a google or bing or yahoo A302 redirect to another website which is fine, if you did it is really bad if your web server says i'm dancomm and i'm going 302 on evil redirect, that means something happened in the chain, right, that means that somewhere in DNS Dan has been equated with evil and we never want Dan equated with evil if you advance in this career it's amazing good to know where to find unicode and urlencoding as you advance in this career it is an amazingly good thing to know one other thing that is good to know The extensions mean an I NC file and an include - File include files are interesting because they contain a lot of the backend server logic for this right when you have a normal PHP page doing things, or no HTML page that makes sense when you include something when you do egg Create a include file that says do that, but drag all that stuff over here and if I can get you to drag my page over here, a nasty come on, better still, all right back File It's a backup file Backup files are fun, you've already gone looking for backup files to shut down someone's entire website, Google backup files are great old files old files are great too because you can compare and see the new file against the old file So old files on a web server are kind of bad, but from a hacker's point of view, old files are great because I can look at the new file and the old file and see what they changed and if I can see where they changed i can start figuring out how they changed code and how they code and if they are sloppy and if it is friday morning or friday afternoon or mon day morning is this is another cross site scripting but what they did here instead of those little tags is they encoded them in percent three charliright so you will see all of this behavior when you go through your logs and I mean it's just amazing how much footprint you leave when you run the tool in order so I want you to be aware of where we are using the tool against victim machines, not Google victim machines Drupal ok I thought you said google for a minute i wanted to say no no, all right, the other will you? Do it too, in your Windows logs you will actually also leave a number of really interesting footprints so this is a windows login, we will know how to get to your event logs in Windows from 160 161 150 See it parallel port- Driver service followed by the following air Well you know we didn't have anything hooked up to the parallel port so why would anyone look for the parallel port, all right, anything connected to a computer is actually great fun to play with and just because it is so isn't actually connected to a network doesn't mean I can't try to override the driver or system volume from that particular program or application, or even as a hardware abstraction layer or elsewhere, so look fine in the computer system so if you have one See number of errors that are sure to happen when going to your operating system scanner, including nd you see people trying to pull things you may not really have hooked up, it's a sign that someone is doing something they shouldn't be right when your security is logged and you see all sorts of policy changes and signing in and out for people you don't know and seeing a whole bunch of account administrations and you know nothing is happening and how do you know you actually need to talk to people? You can't just sit in a booth, you actually have to talk to people when you see a lot of account management going on and you see a lot of really interesting things built in for the new domain, right, that can Somehow telling you that there are some interesting things going on, especially when it is an anonymous login and it was successful on your network. Anonymous logins are awful when you see anonymous logon twice when you are on a DHCP network in the morning they have to somehow authenticate to the network when they turn on the computer, the computer will go ahead and look on the network with a ticket, it is one Kind of anonymous logging in, and then at night when everyone shuts down everybody you've seen those two spikes when you see one at two in the morning. Start questioning this question, never stop questioning everything properly when you go through and see services that are some kind of pastime that cannot be found if you see these warnings correctly, you can Install component on local computer or repair component if damaged.
The installation is fine. I want you to remember one thing about Windows. It works on a threading model.
So when you run a process and fire a process, it starts a series of threads. To properly manage it when you're on UNIX, the parent-child process runs. You have a parent apache and then you have a bunch of little kids ildren then run away and take care of anything they need to take care of threads are essentially the same way, but you can actually make a thread like that how you can open a parent-child relationship, and the moment you open a thread or parent-child relationship that you're in memory, you're actually doing things in that computer's memory.
So if you see something that the installation is corrupted, you can install a repair of the component which means someone went through and tried to break that thread and then play around in memory and run the program I did insisted on not doing the one you wanted me to do right. When a lot of your programs start doing this damaged reinstall, it's a big trigger for some of them to actually either succeed or pound your computer system really hard trying to get in because they don't want your threads and windows because then I can play around in this storage space and do horrible things. The other is really very funny when it shows up as air in the user environment, ok The user environment is the one that most people will be messing with when they get to Metasploity as a network and system level process, but there is a mode to get you into the user environments so that you can actually start doing things in the context of a user when you can't find the correct description for the source, either the component that is triggering the event is not installed or the installation is corrupted, which means someone increased their permissions in the system nine times out of ten important and one of the reasons I didn't want you to put your own equipment in this classroom well because you start seeing these things on your computer because there's nothing like breaking into your friend's computer right away with your logs, and you're going to have those logs digested in week 10 because you have to do a whole bunch of security reports I recorded that so you can really go back and do one Take a look at it so you remember what to look for, so it kind of makes sense, kind of good questions to everyone fine with me
How can I see who has accessed my OneDrive?
See who a file or folder is shared with
- Select the file.
- Click the Information icon. in the upper right to open the Details pane.
- Click Manage Access.
Many of us work remotely with Microsoft Teams.
Have you ever wondered what your boss is keeping track of about your work day? For example, how much time you actually spent on work. Let's find out. (Joy music) Okay, so I logged into the Microsoft 365 admin center.
Here I will show you what kind of information your administrator has access to and what they can extract from the system. Teams has its own dedicated admin center. Let's get to that by listing them all and going to the Teams admin center.
Now let's look at the various reports available to you. Various reports are available here under Analyzes and Reports. For example the use of the app.
Let's go to the last 30 days and run the report. Here we see the different types of apps used in Teams. In this case, there are four Microsoft apps and two third-party apps.
This information is not from the user, it is general. So that we can see that there are two active users using Trello, there are four active users that we are using e Teams, etc. But we cannot see which one here User has used this application.
Let's return to our reports. If your company has calling plans in place, you can get information about the number of minutes users have spent calling and the cost of the calls by running these reports. See Device usage in Teams to see what type of device they are using to get to Teams.
Whether it's Windows, Mac, iOS, Android, etc. What about using teams? “Let's make this report and see what we get. So here we have the list of the different teams and we can see how many messages have been posted within a team, how many replies there have been, urgent messages, reactions, mentions and meetings that have been organized within the team.
If you now click on a team here, you will see all members of the team and if you click on a specific member you will learn a little more about their activities in teams. For example, this person was in two meetings and one call. Under Call History you can see all the calls that this person is like in.
You can also see the duration of the call and the participants, so if I just click on it, for example, I see who with this meeting was, the duration of the call is here and I have more technical information about the devices they used to connect and also the IP address etc. Now let's go back to the usage reports and see what we are below of user activity from teams. When I run the report here, I get an overview of the total number of channel messages, reply messages, and so on, but here I have the display names of the people and their activities on Teams.
So how many channel messages each person sent. Reply messages, post messages, chat messages, meetings in total. So here it is by user and no longer global.
How many one-on-one calls were there, total audio time, total article time, even screen-sharing time and their most recent activity. It doesn't have a timestamp, just the date of its last activity, ok so that's the information you can see by user, now we've checked here is for teams only. But what about the other apps? Are we getting more information per person? Well, let's go back to the Microsoft 365 admin center.
Let's take a look at reports. Here we have the productivity rating. This is only the case at the organizational level.
So what it says here is that no scores are provided at the individual user level. This is a great way to compare your organization to a peer benchmark. It's also broken down into different categories but all of this is at the organization level.
Now let's go to usage and see what we get here. These reports show how people in the company are using 365 services. If I scroll down I can see how many active users are using microsoft 365 services and i can see this by service i can see the microsoft 365 apps but again this is general.
So this is at the organizational level. I can't see exactly which active user is using this app here. I can also see email activity and Microsoft Teams activity Check out this report here so let's see more and let's scroll down, this is where I see all of the usernames and I can see their recent activity for certain services.
So here, when was the last time the user reader sent an email, when was the last time they did something in OneDrive? , or did you do something in SharePoint, in Skype? Then here we have Yammer and the last activity in Microsoft Teams, OK that's the information we get at the user level. The other information is all available at the organization level, so that's what is currently being tracked with Microsoft Teams, in my experience when working with a remote team, it is always better to assign tasks and goals, for example with Planner, rather than micromanaging each person and keeping track of their working hours. If you want to learn more about Planner, watch this article, that gives you a complete introduction.
Hope you found this article useful, if so, don't forget to cross your thumbs up and subscribe to this channel if you are not already subscribed. Thanks for watching and we'll see you in the next article. (upbeat music)
Is it possible to see the OneDrive activities log files?
You can follow the question or vote as helpful, but you cannot reply to this thread. For end users, it’s not feasible to see the OneDrive Activities Log files on local computers. The .etl logs are used to troubleshooting the OneDrive issue by the related team.
Where can I find activity reports on OneDrive?
Use the OneDrive activity reports to get the activity of every user licensed to use OneDrive by looking at their interaction with files on OneDrive. These reports can help you to understand the level of collaboration going on by showing the number of files shared.
What do the.etl logs show on OneDrive?
The .etl logs are used to troubleshooting the OneDrive issue by the related team. We can’t view the logs by ourselves. As a workaround, we can use the new OneDrive sync client as we can see some sync status via clicking the OneDrive icon like below.
How do I create a new activity log in azure?
From the Azure Monitor menu in the Azure portal, select Activity log. Click Diagnostic settings. Click the purple banner for the legacy experience. If a log profile already exists, you first need to remove the existing log profile and then create a new one.