{"id":2671,"date":"2018-11-02T22:11:27","date_gmt":"2018-11-02T22:11:27","guid":{"rendered":"http:\/\/microsoftgeek.com\/?p=2671"},"modified":"2018-11-02T23:10:53","modified_gmt":"2018-11-02T23:10:53","slug":"recovering-deleted-email-with-new-exchange-online-cmdlets","status":"publish","type":"post","link":"https:\/\/microsoftgeek.com\/?p=2671","title":{"rendered":"Recovering Deleted Email with New Exchange Online Cmdlets"},"content":{"rendered":"

Exchange Makes It Easy for Users to Fix Deletion Mistakes<\/h2>\n

Exchange has used a two-step item deletion process for nearly 20 years. When someone deletes an item from a mailbox, it moves into the Deleted Items folder. Later, when the user empties the Deleted Items folder, or the Managed Folder Assistant empties the folder under the instruction of a retention policy, the items go into the Recoverable Item folder. Users can rescue items from Recoverable Items using the Recover Deleted Items feature in OWA or Outlook (Figure 1).<\/p>\n

\"Outlook<\/figure>\n

 <\/p>\n

When Microsoft added the Recover Deleted Items feature to Exchange 2000, the idea was to avoid administrators having to restore deleted items from backup tapes. If users made a mistake, they can fix the problem themselves.<\/p>\n

Eventually, the Managed Folder Assistant clears deleted items out of Recoverable Items and they become irrecoverable. The exception to the rule is when items come under the control of a hold, in which case Exchange holds the items until the hold expires.<\/p>\n

When Exchange Admins Rescue Users<\/h2>\n

Although Recover Deleted Items works, it is a mechanism best suited to restoring limited numbers of items. If someone deletes a folder holding thousands of items and doesn\u2019t notice the problem, that folder and its items eventually end up in Recoverable Items and might need to be restored. Invariably, this is a problem that users are quick to escalate to look for help. Another reason why someone might seek assistance is when they cannot see the wood for the trees and cannot find the item they want by scrolling through the list presented by Recover Deleted Items.<\/p>\n

Up to now, an admin might fix the problem by logging into the user\u2019s mailbox with OWA, find the items, and restore them. This approach works, but it means that the admin must assign themselves permission to open the user\u2019s mailbox, and that\u2019s not usually a good thing, especially when the mailbox belongs to someone who works with confidential or sensitive information.<\/p>\n

Two New Cmdlets<\/h2>\n

Exchange Online now boasts\u00a0two new cmdlets\u00a0to help.<\/p>\n

    \n
  • Get-RecoverableItems<\/em>\u00a0executes basic searches of the Deleted Items and Recoverable Items folders to find items without the need to sign into the mailbox.<\/li>\n
  • Restore-RecoverableItems<\/em>\u00a0finds and copies items from Deleted Items or Recoverable Items to their original folders.<\/li>\n<\/ul>\n

    The basic idea is that you use\u00a0Get-RecoverableItems<\/em>\u00a0to construct a search to find the desired items and then use the search as input to\u00a0Restore-RecoverableItems<\/em>\u00a0when you are sure that it will process the correct items. Before trying to run these cmdlets, make sure that the account you use to sign into PowerShell holds the Exchange \u201cMailbox Import Export\u201d RBAC role.<\/p>\n

    To find out who has the role already, you can run the following command. In the example, the members of the Organization Management role group have the role as does the Administrator account.<\/p>\n

    \n
    \n
    \n
    <\/div>\n
    <\/div>\n
    <\/div>\n

    PowerShell<\/span><\/p>\n<\/div>\n<\/div>\n

    \u00a0<\/span><\/div>\n
    \n\n\n\n
    \n
    \n
    1<\/span><\/div>\n
    2<\/span><\/div>\n
    3<\/span><\/div>\n
    4<\/span><\/div>\n
    5<\/span><\/div>\n
    6<\/span><\/div>\n<\/div>\n<\/td>\n
    		\n
    \n
    Get-ManagementRoleAssignment<\/span> -Role<\/span> “Mailbox Import Export”<\/span> |<\/span> Format-Table<\/span> RoleAssigneeName<\/span><\/span><\/div>\n
    \u00a0<\/span><\/div>\n
    RoleAssigneeName<\/span><\/div>\n
    —<\/span>—<\/span>—<\/span>—<\/span>—<\/span>—<\/span>—<\/span>—<\/span><\/span><\/div>\n
    Organization <\/span>Management<\/span><\/span><\/div>\n
    Administrator<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

    Get-RecoverableItems<\/h2>\n

    This example shows how to search a mailbox for email items (Ipm.Note) in the RecoverableItems folder.<\/p>\n

    \n
    \n
    \n
    <\/div>\n
    <\/div>\n
    <\/div>\n
    <\/div>\n

    PowerShell<\/span><\/p>\n<\/div>\n<\/div>\n

    \u00a0<\/span><\/div>\n
    \n\n\n\n
    \n
    \n
    1<\/span><\/div>\n<\/div>\n<\/td>\n
    		\n
    \n
    Get-RecoverableItems<\/span> -Identity<\/span> TRedmond<\/span> -SourceFolder<\/span> RecoverableItems<\/span> -FilterStartTime<\/span> “2\/16\/2018 10:00:00”<\/span> -FilterEndTime<\/span> “2\/16\/2018 17:00:00”<\/span> -FilterItemType<\/span> Ipm<\/span>.<\/span>Note<\/span><\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

    The date\/times used in the filter are not the creation timestamp. Instead, they are when the user or the Managed Folder Assistant moved the item into its current folder. For instance, if a mailbox has a retention policy that moves items from Deleted Items into Recoverable Items after 120 days, the Managed Folder Assistant might have processed the items found by the search above at least four months ago.<\/p>\n

    A user can bypass Deleted Items and send an item direct to Recoverable Items by using the SHIFT\/Delete key combination. In this case, the\u00a0LastModifiedTime<\/em>\u00a0property (used for date filters) is the date when the user executed SHIFT\/Delete.<\/p>\n

    If you want to search the Deleted Items folder instead of Recoverable Items, specify \u201cDeletedItems\u201d (these values are language independent). You cannot create a search for both the Deleted Items and Recoverable Items folders, so if you want to check the two folders, you need two separate searches. You also cannot search either folder in the archive mailbox. Likewise, you can specify different types of items to look for (like\u00a0Ipm.Appointment<\/em>\u00a0for a calendar item or\u00a0Ipm.Contact<\/em>\u00a0for a contact), but you cannot combine different item types in a search.<\/p>\n

    Users might not be certain when an item was deleted, but they might be able to tell you the message subject. If so, you can search like this:<\/p>\n

    \n
    \n
    \n
    <\/div>\n
    <\/div>\n
    <\/div>\n

    PowerShell<\/span><\/p>\n<\/div>\n<\/div>\n

    \u00a0<\/span><\/div>\n
    \n\n\n\n
    \n
    \n
    1<\/span><\/div>\n<\/div>\n<\/td>\n
    		\n
    \n
    Get-RecoverableItems<\/span> -Identity<\/span> Marc<\/span>.<\/span>Vigneau<\/span> -SourceFolder<\/span> DeletedItems<\/span> -SubjectContains<\/span> “Tasks<\/span>\u201d<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

    Be aware that a search based on\u00a0SubjectContains<\/em>\u00a0finds any item that contains the string in its subject. In this case, it will unearth items with subjects like \u201cMy Tasks\u201d and \u201cHard and Difficult Tasks\u201d and \u201cTasks 2017.\u201d<\/p>\n

    The example of the data returned for found items is shown below.<\/p>\n

    \n
    \n
    \n
    <\/div>\n
    <\/div>\n
    <\/div>\n
    <\/div>\n

    PowerShell<\/span><\/p>\n<\/div>\n<\/div>\n

    \u00a0<\/span><\/div>\n
    \n\n\n\n
    \n
    \n
    1<\/span><\/div>\n
    2<\/span><\/div>\n
    3<\/span><\/div>\n
    4<\/span><\/div>\n
    5<\/span><\/div>\n
    6<\/span><\/div>\n
    7<\/span><\/div>\n
    8<\/span><\/div>\n
    9<\/span><\/div>\n
    10<\/span><\/div>\n
    11<\/span><\/div>\n
    12<\/span><\/div>\n<\/div>\n<\/td>\n
    		\n
    \n
    Identity<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 :<\/span> FoTJp<\/span>+<\/span>dslCpMvzflTJoPw98AAk3A87FGAAAAAO<\/span>+<\/span>4Ga1BbPZCivtiNBUcCOEHAITJp+<\/span>dslCpMvzflTJoPw98AAAAAARQAAITJp<\/span>+<\/span>dslCpMvzflTJoPw98AAk1<\/span>\/<\/span>hRYAAAk<\/span>=<\/span><\/span><\/div>\n
    MailboxIdentity<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0 :<\/span> Marc<\/span>.<\/span>Vigneau<\/span><\/span><\/div>\n
    ItemClass<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 :<\/span> IPM<\/span>.<\/span>Note<\/span><\/span><\/div>\n
    Subject<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 :<\/span> You <\/span>have <\/span>been <\/span>added <\/span>to<\/span> a<\/span> team <\/span>in<\/span> Microsoft <\/span>Teams<\/span><\/span><\/div>\n
    EntryID<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 :<\/span> 00000000EFB819AD416CF6428AFB6234151C08E1070084C9A7E76C942A4CBF37E54C9A0FC3DF000000000114000084C9A7E76C942A4CBF37E54C9A0FC3DF00024D7F85160000<\/span><\/div>\n
    SourceFolder<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 :<\/span> Recoverable <\/span>Items<\/span>\\<\/span>Deletions<\/span><\/span><\/div>\n
    LastParentFolderID<\/span>\u00a0\u00a0 :<\/span> 84C9A7E76C942A4CBF37E54C9A0FC3DF00000000010C<\/span><\/div>\n
    LastModifiedTime<\/span>\u00a0\u00a0\u00a0\u00a0 :<\/span> 02\/<\/span>16\/<\/span>2018 11:<\/span>43:<\/span>21<\/span><\/div>\n
    LastParentPath<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 :<\/span> Bo<\/span>\u00eete <\/span>de<\/span> r<\/span>\u00e9ception<\/span><\/span><\/div>\n
    OriginalFolderExists<\/span> :<\/span> True<\/span><\/span><\/div>\n
    IsValid<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 :<\/span> True<\/span><\/span><\/div>\n
    ObjectState<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 :<\/span> New<\/span><\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

    Obviously, the more precise the search, the more likely you are to find the right item.<\/p>\n

    Recovering Items<\/h2>\n

    Once you are happy that your search finds the right items, you can proceed to recovery. The\u00a0Restore-RecoverableItems<\/em>cmdlet takes the same search that you use to find items and restores each item to its original location:<\/p>\n

    \n
    \n
    \n
    <\/div>\n
    <\/div>\n
    <\/div>\n

    PowerShell<\/span><\/p>\n<\/div>\n<\/div>\n

    \u00a0<\/span><\/div>\n
    \n\n\n\n
    \n
    \n
    1<\/span><\/div>\n<\/div>\n<\/td>\n
    		\n
    \n
    Restore-RecoverableItems<\/span> -Identity<\/span> Marc<\/span>.<\/span>Vigneau<\/span> -SubjectContains<\/span> “Team”<\/span> -SourceFolder<\/span> RecoverableItems<\/span><\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n

    Of course, if you wanted to, you could create your own processing loop to process a batch of mailboxes and restore the messages if any matches are in Recoverable Items (Figure 2). Here\u2019s an example:<\/p>\n

    \n
    \n
    \n
    <\/div>\n
    <\/div>\n
    <\/div>\n
    <\/div>\n

    PowerShell<\/span><\/p>\n<\/div>\n<\/div>\n

    \u00a0<\/span><\/div>\n
    \n\n\n\n
    \n
    \n
    1<\/span><\/div>\n
    2<\/span><\/div>\n
    3<\/span><\/div>\n
    4<\/span><\/div>\n
    5<\/span><\/div>\n<\/div>\n<\/td>\n
    		\n
    \n
    $Mbx<\/span> =<\/span> (<\/span>Get-Mailbox<\/span> -RecipientTypeDetails<\/span> UserMailbox<\/span> -Filter<\/span> {<\/span>CustomAttribute1<\/span> -eq<\/span> “IT”<\/span>}<\/span> |<\/span> Select<\/span> Alias<\/span>,<\/span> DisplayName<\/span>)<\/span><\/span><\/div>\n
    Write-Host<\/span> “Recovering items for”<\/span> $Mbx<\/span>.<\/span>Count<\/span> “mailboxes…”<\/span><\/span><\/div>\n
    ForEach<\/span> (<\/span>$M<\/span> in<\/span> $Mbx<\/span>)<\/span> {<\/span><\/span><\/div>\n
    \u00a0\u00a0 <\/span>Write-Host<\/span> “Checking mailbox”<\/span> $M<\/span>.<\/span>DisplayName<\/span><\/span><\/div>\n
    \u00a0\u00a0 <\/span>Restore-RecoverableItems<\/span> -Identity<\/span> $M<\/span>.<\/span>Alias<\/span> -SourceFolder<\/span> RecoverableItems<\/span> -SubjectContains<\/span> “Important and Critical Message”<\/span> }<\/span><\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n
    \"Restore-RecoverableItems\"<\/figure>\n

     <\/p>\n

    Automation is Good<\/h2>\n

    Anything that automates common administrative operations is goodness. In this case, these cmdlets avoid the need for administrators to sign into user mailboxes to help the owners find missing messages. And like any PowerShell cmdlets, I am sure that people will come up with some interesting methods to exploit this functionality in the future.<\/p>\n","protected":false},"excerpt":{"rendered":"

    Exchange Makes It Easy for Users to Fix Deletion Mistakes Exchange has used a two-step item deletion process for nearly 20 years. When someone deletes an item from a mailbox, it moves into the Deleted Items folder. Later, when the user empties the Deleted Items folder, or the Managed Folder Assistant empties the folder under […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[58,62,73,59],"tags":[],"class_list":["post-2671","post","type-post","status-publish","format-standard","hentry","category-exchange-2013","category-microsoft-exchange-server-2016","category-exchange-server-2019","category-powershell"],"_links":{"self":[{"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=\/wp\/v2\/posts\/2671","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2671"}],"version-history":[{"count":6,"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=\/wp\/v2\/posts\/2671\/revisions"}],"predecessor-version":[{"id":2688,"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=\/wp\/v2\/posts\/2671\/revisions\/2688"}],"wp:attachment":[{"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2671"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2671"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/microsoftgeek.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2671"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}