Office 365 and Full Mailboxes

During the last months I came across an influx of full mailboxes. In most cases were used to relay messages from other platforms. One of those has exceeded our Organization default quota by 102% and of course the rest were at 97% to 99% of the current quota.

My first though was to change the Retention policy down to a month with the users approval and start the  Managed Folder Assistant which unfortunately did not solve the issue. You can find more on that on Sam’s IT Blog.

When working with Exchange online Powershell there are several things to keep in mind:

  • You can have up to 3 Sessions at the same time
  • Exchange Online sessions do have restricted language mode enabled and you can find a way to solve the variable issue on michev.info
  • There is a Powershell Throttle , please refer to this post on how to calculate your micro delays .

The “Old” Solution:

So i preferred to cleanup the mailboxes that try enforce the Retention policy, also the script would be used by our help desk team later on.

The goal was to cleanup 800.000 mails in each mailbox in a Hybrid Exchange environment and keeping only the last month. We start with the classic PSSesion connection to Exchange Online. So the script below is to be used directly in Powershell rather than the specific Azure Powrshell

#Provide your O365 admin account credentials
$UserCredential = Get-Credential

#Import the Exchange online Module
Import-Module msonline

#Create a new Sessions with for Exchange Online and Import it so have locally the full command set
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell/ -Credential $UserCredential -Authentication Basic -AllowRedirection
Import-PSSession $Session

And after we have imported the MSO session locally here is the basic script, I do have some other versions of it to make it more user-friendly but for now the core  is what we need and easier to break it down a bit.

We do a small check on the mailbox statistics based on the Itemcount object, divide the result by 10.000 and then set the Date range that we want to delete. You would ask why to go all these and not get directly to the deleting part. The Search-Mailbox -Deletecontent command can process 10.000 mails at a time.

#Get the list of mails
$mails = get-content “c:\maillist.txt”

Foreach ($mail in $mails) {

#Enumerates the number of mails in the mailbox
$n = Get-MailboxStatistics $mail | Select-object itemcount

#Loop count
$count = $n.itemcount/10000

#Date range
$old = 60
$new = 30
$i = 1
$a = (Get-Date).AddDays(-$old).ToString(‘MM-dd-yyyy’)
$b = (Get-Date).AddDays(-$new).ToString(‘MM-dd-yyyy’)

#Search and delete the mails while increasing the date range by a month

For

do{

$m = Get-Mailbox $mail | Search-Mailbox -SearchQuery “(Received:$a..$b)” -deletecontent -force | Select ResultItemsCount

If ($m.ResultItemsCount -eq 0) {
$old = $old + 30
$a = (Get-Date).AddDays(-$old).ToString(‘MM-dd-yyyy’)
}
$i++

}while ($i -le $count)
Start-ManagedFolderAssistant $mail
}

Remove-PSSession $Session

I would like to note for the really large mailboxes after so many deletions you may encounter the error that the RecoveredItem folder in the mailbox is full you can use the command below but fair warning that would hard delete the data, please use it very carefully.

Get-Mailbox $mail | Search-Mailbox -SearchQuery * -deletecontent  -SearchDumpsterOnly

 

Currently I am working on a bit more advanced script with triggers and Functions while using the Invoke-command -asjob so to speed up the process.

I do hope you found it useful and sooner than later I would have the “New” Solution ready to be presented. Thank you for your time.

 

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s