Exchange: Recover Deleted Items Usage Report
Introduction:
This article is based on a basic requirement of reporting Recover Deleted Items Usage a below.
In Exchange 2013, 2010 to count how many times clients actually "Recover" an email from the Recover Deleted Items area?
For example, if an Outlook user recovers ("moves back") one email from that area to the Deleted Items folder,...that would be "1".
This is helpful when you are trying to determine how many days to keep in Recover Deleted area or in other words set the mailbox\database deleted items retention period.
Default is 14 days, which would suffice most organization. But this article is for the one, who would like to dig in and be more specific.
Get-MailboxDatabase | fl Name,*Ret*
``Name : DB2
``MailboxRetention : 30.00:00:00
``DeletedItemRetention : 14.00:00:00
``RetainDeletedItemsUntilBackup : False
``EventHistoryRetentionPeriod : 7.00:00:00
To begin with set the DeletedItemRetention to 90 days. We will soon know why 90. If you want you can set RetainDeletedItemsUntilBackup to $true.
Get-MailboxDatabase | Set-MailboxDatabase -DeletedItemRetention 90
NOTE:- Always make sure to run the Get-* cmdlets to keep record of the current values before making any changes.
The solution:
You can use Mailbox audit logging to get this information. But be sure you consider the extra space requirement\increase for this log data in the mailboxes.
Default is 90 days data. AuditLogAgeLimit : 90.00:00:00
Steps to enable auditing and generate the report:
**1. **Enable or disable mailbox audit logging for a mailbox or all users
---------------------------#Enable Mailbox Auditing Set-Mailbox User1 -AuditEnabled $true------------------------- #Add what to Audit, in our case 'Move' and 'FolderBind' are important Set-Mailbox satyatest2 -AuditOwner @{Add="FolderBind, MessageBind,Update, Move, MoveToDeletedItems, SoftDelete, HardDelete, FolderBind, SendAs, SendOnBehalf, Create"}------------------------- #Check if the settings are set correctly Get-Mailbox satyatest2 | fl *audit* AuditEnabled : True AuditLogAgeLimit : 90.00:00:00 AuditAdmin : {Update, Move, MoveToDeletedItems, SoftDelete, HardDelete, FolderBind, SendAs, SendOnBehalf, Create} AuditDelegate : {Update, SoftDelete, HardDelete, FolderBind, SendAs, MessageBind, Create} AuditOwner : {Update, Move, MoveToDeletedItems, SoftDelete, HardDelete, FolderBind, SendAs, SendOnBehalf, MessageBind, Create} -----------------------------------------
2. Do some recovery action
Once set wait for 1hr for things to settle down(AD replication, would vary per org). Then login to the mailbox(Outlook or OWA) and do some restoration and deletions from Deleted Items and Recover Deleted Items. Give some time for the data to register, takes a while 15-20 mins can be more sometimes.
3. Search the mailbox for logs
After a while run the below cmdlet to check the details
---------------------------#We are filtering the result based on the SourcePath i.e FolderPathName like *Delet*Search-MailboxAuditLog SatyaTest2 -LogonTypes owner -ShowDetails | ?{$_.FolderPathName -like "*delet*"} | select *PathName,Operation* | ft -auto DestFolderPathName FolderPathName Operation OperationResult------------------ -------------- --------- ---------------\Inbox \Recoverable Items\Deletions Move Succeeded \Recoverable Items\Deletions HardDelete Succeeded\Inbox \Recoverable Items\Deletions Move Succeeded\Inbox \Recoverable Items\Deletions Move Succeeded \Deleted Items SoftDelete Succeeded \Recoverable Items\Deletions FolderBind Succeeded \Deleted Items FolderBind Succeeded---------------------------
Here you can see the number of times user had accessed and moved items from Recoverable Items.
Some more PowerShell Filters:
---------------------------#Target Specific users mailboxes: Get-Mailbox Satyatest* | Search-MailboxAuditLog -LogonTypes owner -ShowDetails | ?{$_.FolderPathName -like "*Recoverable*" -and $_.Operation -eq "Move"} | select MailboxOwnerUPN,*PathName,Operation* | ft -autoMailboxOwnerUPN DestFolderPathName FolderPathName Operation OperationResult--------------- ------------------ -------------- --------- ---------------Satya2@contoso.com \Inbox \Recoverable Items\Deletions Move Succeeded ------------------------- #Target all mailboxes and export to csv: Get-Mailbox | Search-MailboxAuditLog -LogonTypes owner -ShowDetails | ?{$_.FolderPathName -like "*Recoverable*" -and $_.Operation -eq "Move"} | select MailboxOwnerUPN,*PathName,Operation* | Export-Csv AuditReport.csv-------------------------
And finally the exact report you are looking for:
Default data will be max of last 90 days or less.
Get-Mailbox Satyatest* | Select UserPrincipalName,@{n=``'RecoveryCount'``;e={(Search-MailboxAuditLog $_ -LogonTypes owner -ShowDetails |
?{$_.FolderPathName -like ``"*Recoverable*" -and $_.Operation -eq ``"Move"``}).Count}} | ft -auto
UserPrincipalName RecoveryCount
----------------- -------------
SatyaTEST1@contoso.com 0
SatyaTest10@contoso.com 0
SatyaTest11@contoso.com 0
SatyaTEST2@contoso.com 3
SatyaTEST3@contoso.com 0
You can add Export-Csv AuditReport.csv in-place of 'ft -auto' .
Get-Mailbox Satyatest* | Select UserPrincipalName,@{n= 'RecoveryCount' ;e={(Search-MailboxAuditLog $_ -LogonTypes owner -ShowDetails | ?{$_.FolderPathName -like "*Recoverable*" -and $_.Operation -eq "Move"}).Count}} | Export-CSV AuditReport.csv
Although it's not directly related to the days old data been used, but should give a fair idea on the usage frequency to determine the value\weightage of this feature.
References:
Refer to the below post, which contains the PowerShell cmdlets used for similar task.