More verbose logging around Get-MgBetaSecurityAuditLogQueryRecord. Bump version

Author: user

DFIR-O365RC/DFIR-O365RC.psd1

@@ -7,7 +7,7 @@
     RootModule = '.\DFIR-O365RC.psm1'
 
     # Version number of this module.
-    ModuleVersion = '2.0.4'
+    ModuleVersion = '2.0.5'
 
     # Supported PSEditions
     CompatiblePSEditions = 'Core', 'Desktop'

DFIR-O365RC/DFIR-O365RC.psm1

@@ -893,7 +893,9 @@ function Get-UnifiedAuditLogPurview {
             [Int]$retryCount = "0"
             do {
                 try {
+                    "Trying to get events for query $auditLogQueryId" | Write-Log -LogPath $logFile -LogLevel "Info"
                     $records = Get-MgBetaSecurityAuditLogQueryRecord -AuditLogQueryId $auditLogQueryId -All -ErrorAction Stop
+                    "Got events for query $auditLogQueryId" | Write-Log -LogPath $logFile -LogLevel "Info"
                     $stopLoop = $true
                 }
                 catch {
@@ -972,7 +974,7 @@ function Get-MailboxAuditLog {
 				$stopLoop = $true
             }
             catch {
-				if ($_.ToString().contains("ManagementObjectNotFoundException")){
+				if ($_.ToString().contains("ManagementObjectNotFoundException") -or $_.ToString().contains("couldn't be found on")){
                     "$($userId) does not have a mailbox" | Write-Log -LogPath $logFile -LogLevel "Warning"
                     $countMailboxAuditLogEntries = 0
                     $stopLoop = $true