O-Xchange Notes from the Field!

Thursday, January 28, 2016

Use EWS to clean recoverable items folder

Sometimes, you may have the need to clean out recoverable items. We have seen users who have over 90,000 items in the recoverable folders. For details on cleaning up recoverable items folder:

read this:https://technet.microsoft.com/en-us/library/ff678798(v=exchg.150).aspx

The commands below can be used to remove items from recoverable items folder.

When you use search-mailbox to delete recovery items folder (see the powershell commands below)

The commands below deletes all items from deletions folder(under recoverable items folder)

cmdlet #1:
Search-Mailbox -Identity "test" -SearchDumpsterOnly -DeleteContent

Cmdlet #2:
Search-Mailbox -Identity "test" -SearchDumpsterOnly -TargetMailbox "Discovery Search Mailbox" -TargetFolder "test-RecoverableItems" -DeleteContent

This example permanently deletes items from test mailbox Recoverable Items folder and also copies the items to the test-RecoverableItems folder in the Discovery Search Mailbox (a discovery mailbox created by Exchange Setup).

Those commands work but only delete all items from deletions folder(under recoverable items folder). The deleted items are moved to Purges folder.

In my opinion, the best way to delete recoverable items is to delete items from recoverable items root using ews.
Use the script below to delete items from recoverable items folder. You will need to modify script with your cas server fqdn, username, password, domain name and of course the mailbox name you are removing items for.  Copy to notepad and Save as Ps1 file, then run from exchange PowerShell.

Note: This script will delete all items from recoverable items folder root(deletions, versions, purges). Please test before deploying in production.

start script

## Load Managed API dll
Add-Type -Path "C:\Program Files\Microsoft\Exchange\Web Services\2.2\Microsoft.Exchange.WebServices.dll"
## Create Exchange Service Object
$service = New-Object Microsoft.Exchange.WebServices.Data.ExchangeService([Microsoft.Exchange.WebServices.Data.ExchangeVersion]::Exchange2010_SP2)
## Set Credentials
$casserverName = "https://server fqdn"
$userName = "impersonation"
$password =  "impersonate"
$domain = "domain name"
$service.Credentials = New-Object  System.Net.NetworkCredential($username,$password,$domain)
## Set the URL of the CAS (Client Access Server) to use two options are availbe to use Autodiscover to find the CAS URL or Hardcode the CAS to use
$MailboxName = "test@test.com"
#CAS URL Autodiscover
## Set the Folder, and bind to it
$folderid = new-object Microsoft.Exchange.WebServices.Data.FolderId([Microsoft.Exchange.WebServices.Data.WellKnownFolderName]::Recoverableitemsroot,$MailboxName)
$tfTargetFolder = [Microsoft.Exchange.WebServices.Data.Folder]::Bind($service,$folderid)

if($tfTargetFolder -ne $null){
    #Empty the Folder using HardDelete
    $tfTargetFolder.Empty([Microsoft.Exchange.WebServices.Data.DeleteMode]::HardDelete, $true)

End script

Thursday, January 21, 2016

A safer way to deleting unwanted email content from Exchange mailboxes

A safer way to deleting unwanted email content from Exchange mailboxes

Every Exchange Admin/Engineer at some point have been asked to remove unwanted emails from user mailboxes. Use the steps below to find the message/messages, verify and delete

Step 1: Find all recipients of the email and export to csv file using the one-liner below

Get-transportserver | Get-MessageTrackingLog -Start "1/10/2016 9:00AM" -End "1/11/2016 5:00PM" -messagesubject "wormtest" -resultsize unlimited | Select-Object Timestamp,Sender, {$_.recipients}, MessageSubject | export-csv c:\allrecipients.csv

Step 2: Review the csv file from step 1 to confirm recipients. Rename $_.recipients column to Alias

Step 3: Import-csv c:\allrecipients.csv | foreach {Search-Mailbox $_.alias -SearchQuery {subject:'test' AND From:"test@test.com"} -TargetMailbox "discovery" -TargetFolder "discoverfolder" -LogLevel Full -Deletecontent -Force

Using Powershell to Search Mailboxes from a CSV file

 Using  Powershell to Search Mailboxes from a CSV file using criteria below:

a: received date (1/11/2016)
b. subject: virus test a received date and from a user called test@test.com
c. from: test@test.com
d. target mailbox: targetmailbox
e. targetfolder: targetfolder


a.You will need mailbox Import Export role assigned before you can do this
b. Csv file with at least alias column. Csv file in the example below is stored on C:\drive. searchoutput text file is also on C drive

The command below will search mailboxes all users in the csv file with the criteria stated above and log search results in a target folder/mailbox. Results are also stored in searchoutput text file.

Import-csv c:\Message.csv | foreach {Search-Mailbox $_.alias -SearchQuery {subject:'virustest' AND Received:"1/11/2016..1/13/2016" AND From:"test@test.com"} -TargetMailbox "targetmailbox" -TargetFolder "targetfolder" -LogOnly -LogLevel Full} >c:\searchoutput.txt