5

Environment: Office 365 online. Exchange v15.1.933.16.

One of our global administrators performed a remote wipe on a mobile device via the exchange admin centre, and then 'deleted' the device from the EAC. As a result, it is no longer possible to determine in the GUI if the wipe was successful.

Anyone familiar with the cmdlet to check the status of a wipe command? Couldn't find anything with my search so far. Thanks

Edit: Thanks BasitanW, however I should have more clearly indicated that the admin deleted the device after requesting the wipe. No devices are visible in the Exchange Admin Centre, and the Get-MobileDevice command fails to produce a result for this mailbox in PS.

Levi
  • 214
  • 3
  • 9

1 Answers1

10

As written in the MS documentation here:

The remote device wipe feature also includes a confirmation function that writes a time stamp in the sync state data of the user's mailbox. This time stamp is displayed in Outlook Web App and in the user's mobile phone properties dialog box in the EAC.

more detailed infos can be found here:

The Clear-ActiveSyncDevice cmdlet deletes all user data from a mobile device the next time the device receives data from the Microsoft Exchange server. This cmdlet sets the DeviceWipeStatus parameter to $true. The mobile device acknowledges the cmdlet and records the time stamp in the DeviceWipeAckTime parameter.

Update: You might wish to try:

Get-ActiveSyncDevice –Mailbox {mailbox name} | Get-ActiveSyncDeviceStatistics | select DeviceWipeSentTime, DeviceWipeAckTime

or in Exchange 2016 / Exchange Online:

Get-MobileDevice –Mailbox {mailbox name} | Get-MobileDeviceStatistics | select DeviceUserAgent,DeviceWipeSentTime,DeviceWipeAckTime
BastianW
  • 2,848
  • 4
  • 19
  • 34
  • Thanks much BastianW, however this doesn't address the underlying issue (i.e. that the devices were deleted from the mailbox after wipe). Get-MobileDevice (and/or Get-ActiveSyncDevice) both fail to retrieve devices attached to this mailbox. – Levi Mar 08 '17 at 13:36
  • 3
    I´m sorry but my posting still answered your question because it clearly states: "writes a time stamp in the sync state data of the user's mailbox". So if the admin deleted the mobile device it also deleted the sync state data (you can see that as well via the powershell infos above). There is no other place as outlined above which saved this kind of information your are looking for. So if the device is wiped and if the device pairing is then deleted this also deleted the info's you are looking for. – BastianW Mar 08 '17 at 13:49