by

eDiscovery script for reporting on massive gadgets in a Mailbox

eDiscovery script for reporting on massive gadgets in a Mailbox In relation to looking out a Mailbox with EWS with a Script, eDiscovery on Change 2013 makes issues rather a lot simpler and quicker by mainly permitting a Mailbox (and Archive) broad search slightly then a folder by folder crawl which you needed to do with AQS on Change 2010.

I posted a paging pattern just a few months again to point out how one can web page via the outcomes of a eDiscovery utilizing the EWS Managed API. The next script is an software of this to supply a report of Objects which are bigger then a sure measurement within the Mailbox and Archive. To provide the Folder path of the folder the place the gadgets are situated the script grabs the FolderPaths and produces a report like
To run a discovery simply feed it the Mailbox you wish to run it towards, and to set the scale of the Objects you wish to discover you may modify the next variable that holds the KQL question (the next finds gadgets bigger then 10 MB)
$KQL = “size>10485760” 
I’ve put a download of this script right here the code itself appears to be like like
  1. ## Get the Mailbox to Entry from the 1st commandline argument  
  2.   
  3. $MailboxName = $args[0]  
  4.   
  5. $KQL = “size>10485760”;            
  6.   
  7. $SearchableMailboxString = $MailboxName;  
  8.   
  9. ## Load Managed API dll    
  10. Add-Kind -Path “C:Program FilesMicrosoftExchangeWeb Services2.0Microsoft.Exchange.WebServices.dll”    
  11.     
  12. ## Set Change Model    
  13. $ExchangeVersion = [Microsoft.Exchange.WebServices.Data.ExchangeVersion]::Change2013    
  14.     
  15. ## Create Change Service Object    
  16. $service = New-Object Microsoft.Change.WebServices.Information.ExchangeService($ExchangeVersion)    
  17.     
  18. ## Set Credentials to use two choices are availible Option1 to use explict credentials or Choice 2 use the Default (logged On) credentials    
  19.     
  20. #Credentials Choice 1 utilizing UPN for the home windows Account    
  21. $psCred = Get-Credential    
  22. $creds = New-Object System.Web.NetworkCredential($psCred.UserName.ToString(),$psCred.GetNetworkCredential().password.ToString())    
  23. $service.Credentials = $creds        
  24.     
  25. #Credentials Choice 2    
  26. #service.UseDefaultCredentials = $true    
  27.     
  28. ## Select to ignore any SSL Warning points induced by Self Signed Certificates    
  29.     
  30. ## Code From http://poshcode.org/624  
  31. ## Create a compilation setting  
  32. $Supplier=New-Object Microsoft.CSharp.CSharpCodeProvider  
  33. $Compiler=$Supplier.CreateCompiler()  
  34. $Params=New-Object System.CodeDom.Compiler.CompilerParameters  
  35. $Params.GenerateExecutable=$False  
  36. $Params.GenerateInMemory=$True  
  37. $Params.IncludeDebugInformation=$False  
  38. $Params.ReferencedAssemblies.Add(“System.DLL”) | Out-Null  
  39.   
  40. $TASource=@ 
  41.   namespace Native.ToolkitExtensions.Web.CertificatePolicy{ 
  42.     public class TrustAll : System.Web.ICertificatePolicy { 
  43.       public TrustAll() {  
  44.       } 
  45.       public bool CheckValidationResult(System.Web.ServicePoint sp, 
  46.         System.Safety.Cryptography.X509Certificates.X509Certificates cert,  
  47.         System.Web.WebRequest req, int downside) { 
  48.         return true; 
  49.       } 
  50.     } 
  51.   } 
  52. @   
  53. $TAResults=$Supplier.CompileAssemblyFromSource($Params,$TASource)  
  54. $TAAssembly=$TAResults.CompiledAssembly  
  55.   
  56. ## We now create an occasion of the TrustAll and connect it to the ServicePointManager  
  57. $TrustAll=$TAAssembly.CreateInstance(“Local.ToolkitExtensions.Net.CertificatePolicy.TrustAll”)  
  58. [System.Net.ServicePointManager]::CertificatePolicy=$TrustAll  
  59.   
  60. ## finish code from http://poshcode.org/624  
  61.     
  62. ## Set the URL of the CAS (Consumer Entry Server) to use two choices are availbe to use Autodiscover to discover the CAS URL or Hardcode the CAS to use    
  63.     
  64. #CAS URL Choice 1 Autodiscover    
  65. $service.AutodiscoverUrl($MailboxName,{$true})    
  66. “Using CAS Server : “ + $Service.url     
  67.      
  68. #CAS URL Choice 2 Hardcoded    
  69.     
  70. #$uri=[system.URI] “https://casservername/ews/exchange.asmx”    
  71. #$service.Url = $uri      
  72.     
  73. ## Non-compulsory part for Change Impersonation    
  74.     
  75. #$service.ImpersonatedUserId = new-object Microsoft.Change.WebServices.Information.ImpersonatedUserId([Microsoft.Exchange.WebServices.Data.ConnectingIdType]::SmtpAddress, $MailboxName)   
  76.   
  77. ##get folder Paths  
  78. #Outline Operate to convert String to FolderPath    
  79. perform ConvertToString($ipInputString){    
  80.     $Val1Text = “”    
  81.     for ($clInt=0;$clInt -lt $ipInputString.size;$clInt++){    
  82.             $Val1Text = $Val1Text + [Convert]::ToString([Convert]::ToChar([Convert]::ToInt32($ipInputString.Substring($clInt,2),16)))    
  83.             $clInt++    
  84.     }    
  85.     return $Val1Text    
  86. }   
  87.   
  88.   
  89. perform GetFolderPaths{  
  90.     param (  
  91.             $rootFolderId = “$( throw ‘rootFolderId is a mandatory Parameter’ )”,  
  92.             $Archive = “$( throw ‘Archive is a mandatory Parameter’ )”  
  93.           )  
  94.     course of{  
  95.     #Outline Prolonged properties    
  96.     $PR_FOLDER_TYPE = new-object Microsoft.Change.WebServices.Information.ExtendedPropertyDefinition(13825,[Microsoft.Exchange.WebServices.Data.MapiPropertyType]::Integer);    
  97.     $folderidcnt = $rootFolderId  
  98.     #Outline the FolderView used for Export ought to not be any bigger then 1000 folders due to throttling    
  99.     $fvFolderView =  New-Object Microsoft.Change.WebServices.Information.FolderView(1000)    
  100.     #Deep Transval will guarantee all folders in the search path are returned    
  101.     $fvFolderView.Traversal = [Microsoft.Exchange.WebServices.Data.FolderTraversal]::Deep;    
  102.     $psPropertySet = new-object Microsoft.Change.WebServices.Information.PropertySet([Microsoft.Exchange.WebServices.Data.BasePropertySet]::FirstClassProperties)    
  103.     $PR_Folder_Path = new-object Microsoft.Change.WebServices.Information.ExtendedPropertyDefinition(26293, [Microsoft.Exchange.WebServices.Data.MapiPropertyType]::String);    
  104.     #Add Properties to the  Property Set    
  105.     $psPropertySet.Add($PR_Folder_Path);    
  106.     $fvFolderView.PropertySet = $psPropertySet;    
  107.     #The Search filter will exclude any Search Folders    
  108.     $sfSearchFilter = new-object Microsoft.Change.WebServices.Information.SearchFilter+IsEqualTo($PR_FOLDER_TYPE,“1”)    
  109.     $fiResult = $null    
  110.     #The Do loop will deal with any paging that is required if there are extra the 1000 folders in a mailbox    
  111.     do {    
  112.         $fiResult = $Service.FindFolders($folderidcnt,$sfSearchFilter,$fvFolderView)    
  113.         foreach($ffFolder in $fiResult.Folders){    
  114.             $foldpathval = $null    
  115.             #Strive to get the FolderPath Worth and then covert it to a usable String     
  116.             if ($ffFolder.TryGetProperty($PR_Folder_Path,[ref] $foldpathval))    
  117.             {    
  118.                 $binarry = [Text.Encoding]::UTF8.GetBytes($foldpathval)    
  119.                 $hexArr = $binarry | ForEach-Object { $_.ToString(“X2”) }    
  120.                 $hexString = $hexArr -join     
  121.                 $hexString = $hexString.Exchange(“FEFF”“5C00”)    
  122.                 $fpath = ConvertToString($hexString)    
  123.             }    
  124.             “FolderPath : “ + $fpath    
  125.             if($Archive){  
  126.                 $Script:FolderCache.Add($ffFolder.Id.UniqueId,“Archive-Mailbox” + $fpath); 
  127.             } 
  128.             else{ 
  129.                 $Script:FolderCache.Add($ffFolder.Id.UniqueId,$fpath); 
  130.             } 
  131.         }  
  132.         $fvFolderView.Offset += $fiResult.Folders.Rely 
  133.     }whereas($fiResult.MoreAvailable -eq $true)   
  134.     } 
  135. } 
  136.  
  137. $Script:FolderCache = New-Object system.collections.hashtable 
  138. GetFolderPaths -rootFolderId (new-object Microsoft.Change.WebServices.Information.FolderId([Microsoft.Exchange.WebServices.Data.WellKnownFolderName]::MsgFolderRoot,$MailboxName)) -Archive $false   
  139. GetFolderPaths -rootFolderId (new-object Microsoft.Change.WebServices.Information.FolderId([Microsoft.Exchange.WebServices.Data.WellKnownFolderName]::ArchiveMsgFolderRoot,$MailboxName)) -Archive $true  
  140.  
  141. $gsMBResponse = $service.GetSearchableMailboxes($SearchableMailboxString, $false); 
  142. $gsMBResponse 
  143. $msbScope = New-Object  Microsoft.Change.WebServices.Information.MailboxSearchScope[] $gsMBResponse.SearchableMailboxes.Size 
  144. $mbCount = 0; 
  145. foreach ($sbMailbox in $gsMBResponse.SearchableMailboxes) 
  146. { 
  147.     $msbScope[$mbCount] = New-Object Microsoft.Change.WebServices.Information.MailboxSearchScope($sbMailbox.ReferenceId, [Microsoft.Exchange.WebServices.Data.MailboxSearchLocation]::All); 
  148.     $mbCount++; 
  149. } 
  150. $smSearchMailbox = New-Object Microsoft.Change.WebServices.Information.SearchMailboxesParameters 
  151. $mbq =  New-Object Microsoft.Change.WebServices.Information.MailboxQuery($KQL, $msbScope); 
  152. $mbqa = New-Object Microsoft.Change.WebServices.Information.MailboxQuery[] 1 
  153. $mbqa[0] = $mbq 
  154. $smSearchMailbox.SearchQueries = $mbqa; 
  155. $smSearchMailbox.PageSize = 100; 
  156. $smSearchMailbox.PageDirection = [Microsoft.Exchange.WebServices.Data.SearchPageDirection]::Subsequent; 
  157. $smSearchMailbox.PerformDeduplication = $false;            
  158. $smSearchMailbox.ResultType = [Microsoft.Exchange.WebServices.Data.SearchResultType]::PreviewOnly; 
  159. $srCol = $service.SearchMailboxes($smSearchMailbox); 
  160. $rptCollection = @() 
  161.  
  162. if ($srCol[0].Consequence -eq [Microsoft.Exchange.WebServices.Data.ServiceResult]::Success) 
  163. { 
  164.     Write-Host (“Objects Discovered ” + $srCol[0].SearchResult.ItemCount) 
  165.     if ($srCol[0].SearchResult.ItemCount -gt 0) 
  166.     {                   
  167.         do 
  168.         { 
  169.             $smSearchMailbox.PageItemReference = $srCol[0].SearchResult.PreviewItems[$srCol[0].SearchResult.PreviewItems.Size – 1].SortValue; 
  170.             foreach ($PvItem in $srCol[0].SearchResult.PreviewItems) { 
  171.                 $rptObj = “” | choose FolderPath,DateTimeReceived,Topic,Dimension 
  172.                 if($Script:FolderCache.ContainsKey($PvItem.ParentId.UniqueId)){ 
  173.                     $rptObj.FolderPath = $Script:FolderCache[$PvItem.ParentId.UniqueId] 
  174.                     $rptObj.DateTimeReceived = $PvItem.ReceivedTime 
  175.                     $rptObj.Topic = $PvItem.Topic 
  176.                     $rptObj.Dimension = $PvItem.Dimension 
  177.                 }else{ 
  178.                     $rptObj.DateTimeReceived = $PvItem.ReceivedTime 
  179.                     $rptObj.Topic = $PvItem.Topic 
  180.                     $rptObj.Dimension = $PvItem.Dimension 
  181.                 } 
  182.                 $rptObj 
  183.                 $rptCollection+=$rptObj 
  184.             }                         
  185.             $srCol = $service.SearchMailboxes($smSearchMailbox); 
  186.             Write-Host(“Objects Remaining : ” + $srCol[0].SearchResult.ItemCount);  
  187.         } whereas ($srCol[0].SearchResult.ItemCount-gt 0 );  
  188.           
  189.     }  
  190.       
  191. }  
  192. $rptCollection | Export-Csv -NoTypeInformation -Path c:tempLaItemReport.csv