NDR hunt using the EWS Managed API and Powershell to find and delete NDR messages in a mailbox

While this is the time of year that we are more often concerned with hunting down round chocolate things to stuff in our gobs one endearing task most mail administrators must deal with is the management of NDR messages. NDR’s while exceedingly useful at the time a problem occurs once this time has passed their usefulness falls and they tend to become redundant fragments of information that can clutter a mailbox. Especially if you are copying these items to an administrator mailbox you can soon see the mailbox size and item count shot up exponentially if cleanups aren’t occurring on a frequent basis. Because deleting email can be a very tedious process this is something that can be easily scripted using the EWS Managed API and powershell with a few general provisos. First because in some case you maybe deleting a lot of items (eg I had to remove over 100000) using the batching features of EWS is highly desirable which will reduce the number of requests you need to make to the server and make the script run in some sort of reasonable time.

To use batching with the EWS Managed API you need to make use of generictypes which presents a little bit of challenge in Powershell v1. To get around this you need to use something like this is PS v1 to great a generic List type of EWS Items.

$Itemids = [activator]::createinstance(([type]'System.Collections.Generic.List`1').makegenerictype([Microsoft.Exchange.WebServices.Data.ItemId]))

Other important parts of this script is that with the Delete Method in exchange you can move items to the recycle bin, soft delete them or Hard delete them which method you use on a item will affect it retention and recoverability of that item. In this script because this is a example im using SoftDelete which give some chance of redemption in production once tested you probably want to switch to HardDelete.

[Microsoft.Exchange.WebServices.Data.DeleteMode]::SoftDelete

Care does need to be taken because when you hard delete an item it means generally you won’t be able to recover it except from backup.

The script uses the following searchfilter to limit the items returned to NDR’s

$Sfir = new-object Microsoft.Exchange.WebServices.Data.SearchFilter+IsEqualTo([Microsoft.Exchange.WebServices.Data.ItemSchema]::ItemClass, "REPORT.IPM.Note.NDR")

To run the script itself it takes the name of the mailbox you want to run it against as a cmdline parameter so to run it against the admin account it would take something like

./Ndrhunt.ps1 administrator

Warning this script has had no real testing and because it deletes email I advise you do your own testing first.

I've put a download of this script here the script itself look like


$MailboxName = $args[0]

function RepeartSearch{
$frFolderResult = $InboxFolder.FindItems($Sfir,$view)
$Itemids = [activator]::createinstance(([type]'System.Collections.Generic.List`1').makegenerictype([Microsoft.Exchange.WebServices.Data.ItemId]))
foreach($ndr in $frFolderResult.items){
$Itemids.add($ndr.Id)
}
if ($frFolderResult.Items.Count -ne 0){
$Result = $service.DeleteItems($Itemids,[Microsoft.Exchange.WebServices.Data.DeleteMode]::SoftDelete,[Microsoft.Exchange.WebServices.Data.SendCancellationsMode]::SendToNone,[Microsoft.Exchange.WebServices.Data.AffectedTaskOccurrence]::AllOccurrences)
[INT]$Rcount = 0
foreach ($res in $Result){
if ($res.Result -eq [Microsoft.Exchange.WebServices.Data.ServiceResult]::Success){
$Rcount++
}
}
$Rcount.ToString() + " Items Deleted"
if ($frFolderResult.Items.Count -eq 1000) {
RepeartSearch
}
}
else{
"No Items to delete"
}

}

$dllpath = "C:\Program Files\Microsoft\Exchange\Web Services\1.0\Microsoft.Exchange.WebServices.dll"
[void][Reflection.Assembly]::LoadFile($dllpath)
$service = New-Object Microsoft.Exchange.WebServices.Data.ExchangeService([Microsoft.Exchange.WebServices.Data.ExchangeVersion]::Exchange2007_SP1)

$windowsIdentity = [System.Security.Principal.WindowsIdentity]::GetCurrent()
$sidbind = "LDAP://<SID=" + $windowsIdentity.user.Value.ToString() + ">"
$aceuser = [ADSI]$sidbind

$service.AutodiscoverUrl($aceuser.mail.ToString())

$folderid = new-object Microsoft.Exchange.WebServices.Data.FolderId([Microsoft.Exchange.WebServices.Data.WellKnownFolderName]::Inbox,$MailboxName)
$InboxFolder = [Microsoft.Exchange.WebServices.Data.Folder]::Bind($service,$folderid)
$Sfir = new-object Microsoft.Exchange.WebServices.Data.SearchFilter+IsEqualTo([Microsoft.Exchange.WebServices.Data.ItemSchema]::ItemClass, "REPORT.IPM.Note.NDR")
$view = new-object Microsoft.Exchange.WebServices.Data.ItemView(1000)
$frFolderResult = $InboxFolder.FindItems($Sfir,$view)

$Itemids = [activator]::createinstance(([type]'System.Collections.Generic.List`1').makegenerictype([Microsoft.Exchange.WebServices.Data.ItemId]))
foreach($ndr in $frFolderResult.items){
$Itemids.add($ndr.Id)
}
if ($frFolderResult.Items.Count -ne 0){
$Result = $service.DeleteItems($Itemids,[Microsoft.Exchange.WebServices.Data.DeleteMode]::SoftDelete,[Microsoft.Exchange.WebServices.Data.SendCancellationsMode]::SendToNone,[Microsoft.Exchange.WebServices.Data.AffectedTaskOccurrence]::AllOccurrences)
[INT]$Rcount = 0
foreach ($res in $Result){
if ($res.Result -eq [Microsoft.Exchange.WebServices.Data.ServiceResult]::Success){
$Rcount++
}
}
$Rcount.ToString() + " Items Deleted"
if ($frFolderResult.Items.Count -eq 1000) {
RepeartSearch
}
}
else{
"No Items to delete"
}