Bulk Export Email From Multiple Mailboxes – Powershell / Exchange 2007

Today we experienced a significant onslaught of spam/phishing email into our organization which was not caught by our spam filters.  Luckily, we were able to manually create filters which stopped any additional incoming instances of this attack.

I was approached by our IT Security department to run a “seek and destroy” on the emails which were able to make it through before our blocks were in place.

First, we ran message tracking on the Exchange servers to identify the users who received the malicious email, then exported said users to a .CSV file which was formatted like so:

Name
spamrecipient1@company.com
spamrecipient2@company.com
spamrecipient3@company.com
spamrecipient4@company.com
spamrecipient5@company.com

We can then run an export-mailbox to pull emails with certain keywords from the list of mailboxes in the .CSV we created above.  In this example we used “Reset your Company.com password”.

import-csv “d:\scripts\spamrecipients.csv” | ForEach-object -process {Get-mailbox $_.name | export-mailbox -targetmailbox PhishingCleanupMailbox -targetfolder Phishing -subjectKeyWords “Reset your Company.com password” -deletecontent -confirm:$false -maxthreads 8}

This will scan each mailbox in the .CSV for emails containing the keyword specified, and move them to the mailbox “PhishingCleanupMailbox”, create a folder called “Phishing”, then a subfolder called “Recovered Items – Mailboxname”.  Under Recovered Items, it will re-create the folder structure of the original mailbox.  So wherever the original email was located in the original mailbox, it will be located in the same folder in the Recovered Items.