Recover deleted items from a group mailbox with EWS Managed API 2.2


In case you're interested in recovering the deleted items from a group mailbox...

 
Prerequisites:

-Create a new RBAC group or use an existing one from Exchange Admin Center – Permissions – Admin Roles. Add the ‘ApplicationImpersonation’ role to the group and add as member the service account that will impersonate the mailbox that is a member/owner of the declared group mailbox (it can be your Global Admin account).

 

DISCLAIMER: This application is a sample application. The sample is provided "as is" without warranty of any kind. Microsoft further disclaims all implied warranties including without limitation any implied warranties of merchantability or of fitness for a particular purpose. The entire risk arising out of the use or performance of the samples remains with you. in no event shall Microsoft or its suppliers be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss arising out of the use of or inability to use the samples, even if Microsoft has been advised of the possibility of such damages. Because some states do not allow the exclusion or limitation of liability for consequential or incidental damages, the above limitation may not apply to you.

# The script requires EWS Managed API 2.2, which can be downloaded here: https://www.microsoft.com/en-gb/download/details.aspx?id=42951
# Make sure the Import-Module command matches the Microsoft.Exchange.WebServices.dll location of EWS Managed API, chosen during the installation

$i=$j=0;
$a = Read-Host -Prompt "Mailbox name"
$b = Read-Host -Prompt "Group mailbox"

Import-Module -Name "C:\Program Files\Microsoft\Exchange\Web Services\2.2\Microsoft.Exchange.WebServices.dll"

$service = New-Object Microsoft.Exchange.WebServices.Data.ExchangeService -ArgumentList Exchange2013_SP1

#Provide the credentials of the O365 account that has impersonation rights on the mailbox that you read from the CLI
$service.Credentials = new-object Microsoft.Exchange.WebServices.Data.WebCredentials -ArgumentList "serviceaccount@domain.onmicrosoft.com","Password"

#Exchange Online URL
$service.Url= new-object Uri("https://outlook.office365.com/EWS/Exchange.asmx")

#User to impersonate
$service.ImpersonatedUserId = new-object Microsoft.Exchange.WebServices.Data.ImpersonatedUserId([Microsoft.Exchange.WebServices.Data.ConnectingIdType]::SmtpAddress,$a)

$DeletionsFolderid = new-object Microsoft.Exchange.WebServices.Data.FolderId([Microsoft.Exchange.WebServices.Data.WellKnownFolderName]::RecoverableItemsDeletions,$b)

$InboxFolderid = new-object Microsoft.Exchange.WebServices.Data.FolderId([Microsoft.Exchange.WebServices.Data.WellKnownFolderName]::Inbox,$b)

$CalendarFolderid = new-object Microsoft.Exchange.WebServices.Data.FolderId([Microsoft.Exchange.WebServices.Data.WellKnownFolderName]::Calendar,$b)


$ItemView = new-object Microsoft.Exchange.WebServices.Data.ItemView(1000)

do
{
$FindItemResults = $service.FindItems($DeletionsFolderid,$ItemView)

write-host "$($FindItemResults.TotalCount) item(s) have been found in the Recoverable items folder" -ForegroundColor White

foreach ($Item in $FindItemResults.Items)
{

#Restore the emails

if ($Item.ItemClass -match "IPM.Note")
{

$Message = [Microsoft.Exchange.WebServices.Data.EmailMessage]::Bind($service,$Item.Id)

$Message.Move($InboxFolderid)

$i++;

}

#Restore the calendar events

if ($Item.ItemClass -match "IPM.Appointment")
{

$Message = [Microsoft.Exchange.WebServices.Data.Appointment]::Bind($service,$Item.Id)

$Message.Move($CalendarFolderid)

$j++;

}

if(!$i -and !$j) { Write-Host "The Item with the Subject:'$($Item.Subject)' has the ItemClass '$($Item.ItemClass)' and will not be recovered" -ForegroundColor Yellow }

}

$ItemView.offset += $FindItemResults.Items.Count

}while($FindItemResults.MoreAvailable -eq $true)

Write-Host "$($i) Email(s) were recovered and moved to the Inbox folder" -ForegroundColor White
Write-Host "$($j) Appointment(s) were recovered and moved to the Calendar folder" -ForegroundColor White

 

Note: In order to run the script above, you have to copy paste it into a Notepad file and save it with the extension ".ps1". Then, you have to connect to Exchange Online with PowerShell and run it: https://technet.microsoft.com/en-us/library/jj984289(v=exchg.160).aspx.

 

 

Comments (2)

  1. H Shakir says:

    Hi, thanks for sharing this script, will it work for both O365 Exchange online and Exchange on premises ?

    1. EXO Voice says:

      Hi,
      The script is created for group mailboxes, thus, Exchange Online.

      Thanks,
      Catalin

Skip to main content