Recall-email.ps1
<#PSScriptInfo .VERSION 1.1 .GUID dd89ddf9-564b-4b93-abd1-f691dc978f78 .AUTHOR cjclark@sheriffleefl.org .COMPANYNAME Lee County Sheriff .COPYRIGHT N/A .TAGS .LICENSEURI .PROJECTURI https://sheriffleefl.org/ .ICONURI .EXTERNALMODULEDEPENDENCIES .REQUIREDSCRIPTS .EXTERNALSCRIPTDEPENDENCIES .RELEASENOTES Recalls an Email from the 365 Exchange Online database .PRIVATEDATA #> <# .DESCRIPTION One line to recall an Email #> Param() #This is to create a oneline script to recall emails from 365. #BE EXTREMELY CAREFULL AS THIS PREFORMS A DATABASE PURGE OF THE CONTENT YOU SPECFIED. #Created By Colton Clark #Checking for module ExchangeOnlineManagement. function Recall-Email { param ( #requires -module ExchangeOnlineManagement # OptionalParameters [Parameter(Position = 0, Mandatory = $true)][String]$TargetUserEmail, [Parameter(Position = 1, Mandatory = $False)][String]$Date = $today, [Parameter(Position = 2, Mandatory = $true)][String]$Subject ) #requires -module ExchangeOnlineManagement $today = get-date -Format yyyy-MM-dd $CurrentTime = Get-Date #connect to Exchange Online Connect-IPPSSession #Gatter the emails to delete with/without date defined. if ($today -eq $today ) { New-ComplianceSearch -Name "$env:username at $CurrentTime" -ExchangeLocation All -ContentMatchQuery "from:$TargetUserEmail AND subject:$Subject AND sent:$today" | Start-ComplianceSearch } else { New-ComplianceSearch -Name "$env:username at $CurrentTime" -ExchangeLocation All -ContentMatchQuery "from:$TargetUserEmail AND subject:$Subject" | Start-ComplianceSearch } #Prime the While statements so they run correctly $currentstatus = get-ComplianceSearch -Identity "$env:username at $CurrentTime" | select -ExpandProperty status Start-Sleep -Seconds 5 #Status messages while ($currentstatus -eq 'Starting') { $currentstatus = get-ComplianceSearch -Identity "$env:username at $CurrentTime" | select -ExpandProperty status Write-Host $currentstatus Start-Sleep -Seconds 30 } while ($currentstatus -eq 'InProgress') { $currentstatus = get-ComplianceSearch -Identity "$env:username at $CurrentTime" | select -ExpandProperty status Write-Host $currentstatus Start-Sleep -Seconds 30 } #Delete the discovered Emails New-ComplianceSearchAction -SearchName "$env:username at $CurrentTime" -Purge -PurgeType HardDelete #Status MSG to show they are beeing deleted. $StringToFindPurgeStatus = "$env:username at $CurrentTime"+"_Purge" $deletestatus = get-ComplianceSearchAction -Identity "$StringToFindPurgeStatus" | Select -ExpandProperty Status while ($deletestatus -ne 'Completed') { Write-host "Deleteing Emails..." Start-Sleep -Seconds 10 } Write-host "Script Complete" } |