by

Fast Mailbox Merchandise Sort eDiscovery Powershell script

Fast Mailbox Merchandise Sort eDiscovery Powershell script One of many options of eDiscovery in Alternate 2013 and higher is the flexibility to do a search of Mailbox and simply return the statistics on specific Gadgets (or searches). This lets you do a very fast search with out the necessity to course of any of the ResultSet of the Search.  To restrict the Gadgets varieties returned by an eDiscovery question you should use the sort Key phrase property in a KQL question. The characteristic set of which has not too long ago been up to date https://technet.microsoft.com/en-us/library/dn508399(v=exchg.150).aspx to now will let you embody Lync (or IM) gadgets. So one little cool factor you are able to do with this utilizing a a number of OR logic question with eDiscovery is get a fast record of the variety of trade Gadgets by sort in a Mailbox eg the KQL for this may appear like

“kind:email OR kind:meetings OR kind:contacts OR kind:tasks OR kind:notes OR kind:IM OR kind:rssfeeds OR kind:voicemail”

and this may produce a report that appears like

I’ve put collectively a pattern of a script to do that which you’ll be able to download type right here. To run the script use

Get-MailboxItemTypeStats -MailboxName consumer@area.com -OutputFileName reportfile.csv

The code itself appears like

  1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
####################### 
<#
.SYNOPSIS
Performs an eDiscovery Search utilizing Powershell and the Alternate Internet Companies API in a Mailbox and produces a CSV report of ItemType in that Mailbox

.DESCRIPTION
Performs an eDiscovery Search utilizing Powershell and the Alternate Internet Companies API in a Mailbox and produces a CSV report of ItemType in that Mailbox

Requires the EWS Managed API from https://www.microsoft.com/en-us/download/particulars.aspx?id=42951

.EXAMPLE
PS C:>Get-MailboxItemTypeStats -MailboxName consumer.title@area.com -OutputFileName Report.csv

This Instance Performs an eDiscovery Search utilizing Powershell and the Alternate Internet Companies API in a Mailbox and produces a CSV report of ItemType in that Mailbox
#>
operate Get-MailboxItemTypeStats
{
[CmdletBinding()]
param(
[Parameter(Place=0, Obligatory=$true)] [string]$MailboxName,
[Parameter(Place=1, Obligatory=$true)] [PSCredential]$Credentials,
[Parameter(Place=2, Obligatory=$true)] [string]$OutputFileName
)
Start
{
$KQL = "kind:email OR kind:meetings OR kind:contacts OR kind:tasks OR kind:notes OR kind:IM OR kind:rssfeeds OR kind:voicemail";
$SearchableMailboxString = $MailboxName;

## Load Managed API dll
###CHECK FOR EWS MANAGED API, IF PRESENT IMPORT THE HIGHEST VERSION EWS DLL, ELSE EXIT
$EWSDLL = (($(Get-ItemProperty -ErrorAction SilentlyContinue -Path Registry::$(Get-ChildItem -ErrorAction SilentlyContinue -Path 'Registry::HKEY_LOCAL_MACHINESOFTWAREMicrosoftExchangeWeb Companies'|Type-Object Title -Descending| Choose-Object -First 1 -ExpandProperty Title)).'Set up Listing') + "Microsoft.Exchange.WebServices.dll")
if (Take a look at-Path $EWSDLL)
{
Import-Module $EWSDLL
}
else
{
"$(get-date -format yyyyMMddHHmmss):"
"This script requires the EWS Managed API 1.2 or later."
"Please download and install the current version of the EWS Managed API from"
"http://go.microsoft.com/fwlink/?LinkId=255472"
""
"Exiting Script."
exit
}

## Set Alternate Model
$ExchangeVersion = [Microsoft.Exchange.WebServices.Data.ExchangeVersion]::Alternate2013_SP1

## Create Alternate Service Object
$service = New-Object Microsoft.Alternate.WebServices.Information.ExchangeService($ExchangeVersion)

## Set Credentials to make use of two choices are availible Option1 to make use of explict credentials or Possibility 2 use the Default (logged On) credentials

#Credentials Possibility 1 utilizing UPN for the home windows Account
$creds = New-Object System.Internet.NetworkCredential($Credentials.UserName.ToString(),$Credentials.GetNetworkCredential().password.ToString())
$service.Credentials = $creds
#$service.TraceEnabled = $true
#Credentials Possibility 2
#service.UseDefaultCredentials = $true

## Select to disregard any SSL Warning points brought on by Self Signed Certificates

## Code From http://poshcode.org/624
## Create a compilation setting
$Supplier=New-Object Microsoft.CSharp.CSharpCodeProvider
$Compiler=$Supplier.CreateCompiler()
$Params=New-Object System.CodeDom.Compiler.CompilerParameters
$Params.GenerateExecutable=$False
$Params.GenerateInMemory=$True
$Params.IncludeDebugInformation=$False
$Params.ReferencedAssemblies.Add("System.DLL") | Out-Null

$TASource=@'
namespace Native.ToolkitExtensions.Internet.CertificatePolicy{
public class TrustAll : System.Internet.ICertificatePolicy {
public TrustAll() {
}
public bool CheckValidationResult(System.Internet.ServicePoint sp,
System.Safety.Cryptography.X509Certificates.X509Certificates cert,
System.Internet.WebRequest req, int drawback) {
return true;
}
}
}
'@
$TAResults=$Supplier.CompileAssemblyFromSource($Params,$TASource)
$TAAssembly=$TAResults.CompiledAssembly

## We now create an occasion of the TrustAll and fasten it to the ServicePointManager
$TrustAll=$TAAssembly.CreateInstance("Local.ToolkitExtensions.Net.CertificatePolicy.TrustAll")
[System.Net.ServicePointManager]::CertificatePolicy=$TrustAll

## finish code from http://poshcode.org/624

## Set the URL of the CAS (Consumer Entry Server) to make use of two choices are availbe to make use of Autodiscover to seek out the CAS URL or Hardcode the CAS to make use of

#CAS URL Possibility 1 Autodiscover
$service.AutodiscoverUrl($MailboxName,{$true})
"Using CAS Server : " + $Service.url

#CAS URL Possibility 2 Hardcoded

#$uri=[system.URI] "https://casservername/ews/exchange.asmx"
#$service.Url = $uri

## Non-obligatory part for Alternate Impersonation

#$service.ImpersonatedUserId = new-object Microsoft.Alternate.WebServices.Information.ImpersonatedUserId([Microsoft.Exchange.WebServices.Data.ConnectingIdType]::SmtpAddress, $MailboxName)

$gsMBResponse = $service.GetSearchableMailboxes($SearchableMailboxString, $false);
$msbScope = New-Object Microsoft.Alternate.WebServices.Information.MailboxSearchScope[] $gsMBResponse.SearchableMailboxes.Size
$mbCount = 0;
foreach ($sbMailbox in $gsMBResponse.SearchableMailboxes)
{
$msbScope[$mbCount] = New-Object Microsoft.Alternate.WebServices.Information.MailboxSearchScope($sbMailbox.ReferenceId, [Microsoft.Exchange.WebServices.Data.MailboxSearchLocation]::All);
$mbCount++;
}
$smSearchMailbox = New-Object Microsoft.Alternate.WebServices.Information.SearchMailboxesParameters
$mbq = New-Object Microsoft.Alternate.WebServices.Information.MailboxQuery($KQL, $msbScope);
$mbqa = New-Object Microsoft.Alternate.WebServices.Information.MailboxQuery[] 1
$mbqa[0] = $mbq
$smSearchMailbox.SearchQueries = $mbqa;
$smSearchMailbox.PageSize = 100;
$smSearchMailbox.PageDirection = [Microsoft.Exchange.WebServices.Data.SearchPageDirection]::Subsequent;
$smSearchMailbox.PerformDeduplication = $false;
$smSearchMailbox.ResultType = [Microsoft.Exchange.WebServices.Data.SearchResultType]::StatisticsOnly;
$srCol = $service.SearchMailboxes($smSearchMailbox);
$rptCollection = @()

if ($srCol[0].Outcome -eq [Microsoft.Exchange.WebServices.Data.ServiceResult]::Success)
{
foreach($KeyWorkdStat in $srCol[0].SearchResult.KeywordStats){
if($KeyWorkdStat.Key phrase.Comprises(" OR ") -eq $false) Choose ItemType,ItemHits,Measurement
$rptObj.ItemType = $KeyWorkdStat.Key phrase.Substitute("Kind:","")
$rptObj.ItemHits = $KeyWorkdStat.ItemHits
$rptObj.Measurement = [System.Math]::Spherical($KeyWorkdStat.Measurement /1024/1024,2)
$rptCollection += $rptObj

}
}
Write-Output $rptCollection
$rptCollection | Export-Csv -NoTypeInformation -Path $OutputFileName

}
}