For you reporters out there. Get-UAL and it’s variations. On 2012 and above it’s been silently watching and logging 3 years.

I didn’t find this until a year ago and it’s been great to find out if a service has been accessed and by who. Here’s a link to what it can do Get-UAL. I encourage you to check it out.

Edit:Sheppard_Ra provided a more direct link; Reddit linking, like most things is character sensitive. Thanks Sheppard