/
Remove-Email.ps1
111 lines (95 loc) · 3.55 KB
/
Remove-Email.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
function Remove-Email {
[CmdletBinding(
SupportsShouldProcess = $true,
ConfirmImpact = 'High'
)]
param (
# Username
[Parameter(Mandatory=$true)]
[string]
$Sender,
# Recipients; may be mailbox or distribution group
[Parameter(Mandatory=$false)]
[string]
$Recipient,
# Subject of the email
[Parameter(Mandatory=$true)]
[string]
$Subject,
# Date from
[Parameter(Mandatory=$false)]
[string]
$Start = (Get-Date -Format d),
# Date to
[Parameter(Mandatory=$false)]
[string]
$End = (Get-Date -Format d),
# Delete the email
[Parameter(Mandatory=$false)]
[switch]
$Delete,
# Report recipients
[Parameter(Mandatory=$true)]
[string]
$ReportRecipient,
# Folder to store the search results in
[Parameter(Mandatory=$false)]
[string]
$TargetFolder = 'SearchResults'
)
begin {
try {
Get-ExchangeServer $env:COMPUTERNAME -ErrorAction Stop | Out-Null
}
catch {
Write-Error "Log into an Exchange server with an account that has the Discovery Management role assigned, and run this on the Exchange Management Shell."
break
}
try {
Get-Mailbox $ReportRecipient -ErrorAction Stop | Out-Null
}
catch {
Write-Error "Unable to locate the mailbox for $ReportRecipient. Process aborted."
break
}
}
process {
if ($Subject -match '^(FW:|RE:)') {
$Subject = $Subject -replace '^(FW:|RE:)' -replace '^\ '
}
$QueryString = "FROM:`"$Sender`" AND SUBJECT:`"$Subject`" AND RECEIVED:$Start..$End"
if ($Recipient) {
$RecipientType = (Get-Recipient $Recipient).RecipientType
switch ($RecipientType) {
'MailUniversalDistributionGroup' {
$Command = "Get-DistributionGroupMember '$Recipient' | Get-Mailbox"
break
}
'MailNonUniversalGroup' {
$Members = Get-ADGroupMember $(Get-Recipient $Recipient).Name | ForEach-Object { Get-Mailbox $PsItem.SamAccountName }
$Command = '$Members'
break
}
'UserMailbox' {
$Command = "Get-Mailbox '$Recipient'"
}
Default {
Write-Error "Invalid recipient type. Please check the Recipient parameter."
break
}
}
}
else {
$Command = "Get-Mailbox -ResultSize Unlimited"
}
$Command += " | Search-Mailbox -SearchQuery '$QueryString' -TargetMailbox '$ReportRecipient' -TargetFolder $TargetFolder -LogLevel Full -LogOnly"
$EmailStats = Invoke-Expression -Command $Command | Measure-Object -Property ResultItemsCount -Sum
# Check if the admin wants the email deleted; don't delete it right away.
if ($Delete) {
if ($PSCmdlet.ShouldProcess("$($EmailStats.Sum) emails with subject, '$Subject' from $($EmailStats.Count) mailboxes", "Delete")) {
$Command = $Command.Replace(" -TargetFolder $TargetFolder -LogLevel Full -LogOnly", " -TargetFolder $($TargetFolder + '-Deleted-' + $(Get-Date -Format "yyyy-MM-dd")) -DeleteContent" + ' -Confirm:$false -Force')
}
Invoke-Expression -Command $Command | Out-Null
}
}
}