EWS Managed API: Export Attachments from specific Folder

Nach dem Anlegen der Rolle bekam ich eine Alert Benachrichtigung von Office 365

Der Grund liegt in den "Alert policies" im Office 365 Security and Compliance center. Dort gibt es einen entsprechenden Alarm. Finde ich gut - so etwas gibt es OnPrem nicht - jedenfalls nicht von Hause aus.

Hier nun der PowerShell Code

# Global Vars
[string]$EwsApiDll = "C:\Program Files\Microsoft\Exchange\Web Services\2.2\Microsoft.Exchange.WebServices.dll"
[string]$Email = "ewservice@icewolf.ch"
[string]$Username = "ewservice@icewolf.ch"
[string]$Password = "MySecretPassword"
[string]$Domain = "Corp"
[string]$EWSURL = ""
[string]$EWSURL = "https://outlook.office365.com/EWS/Exchange.asmx"
[string]$ImpersonationMailbox = "a.bohren@icewolf.ch"

Import-Module -Name $EwsApiDll
Write-Host ("Imported EWS Module")

$EWService = new-object Microsoft.Exchange.WebServices.Data.ExchangeService([Microsoft.Exchange.WebServices.Data.ExchangeVersion]::Exchange2010_SP2)
$EWService.Credentials = new-object Microsoft.Exchange.WebServices.Data.WebCredentials($Username,$Password,$Domain)

If ($EWSURL -eq "")
{
 $EWService.AutodiscoverUrl($Email)
 Write-Host ("Using Autodiscover")
} else {
 $EWService.Url = $EWSURL
 Write-Host ("Using EWS URL")
}

Write-Host ("-->Impersonation to Mailbox: " + $ImpoersonMailbox)
$EWService.ImpersonatedUserId = new-object Microsoft.Exchange.WebServices.Data.ImpersonatedUserId([Microsoft.Exchange.WebServices.Data.ConnectingIdType]::SmtpAddress, $ImpersonationMailbox)

###############################################################################
# Save Attachments from Deleted Items
###############################################################################
$offset = 0
do {
 $ItemView = New-Object Microsoft.Exchange.WebServices.Data.ItemView(1000, $offset)   
 $ItemView.PropertySet = new-object Microsoft.Exchange.WebServices.Data.PropertySet([Microsoft.Exchange.WebServices.Data.BasePropertySet]::FirstClassProperties)
 $Items = $EWService.FindItems([Microsoft.Exchange.WebServices.Data.WellKnownFolderName]::DeletedItems,$ItemView)               
 $Items | ft Subject

 foreach ($Item in $Items)
 {
  If ($Item.HasAttachments -eq $true)
  {
   #DEBUG
   Write-Host "Subject: $($Item.Subject)" -ForegroundColor cyan
  
   #Define PropertySet and GetMessage
   $psPropertySet = new-object Microsoft.Exchange.WebServices.Data.PropertySet([Microsoft.Exchange.WebServices.Data.ItemSchema]::Attachments)
   $Message = [Microsoft.Exchange.WebServices.Data.EmailMessage]::Bind($ewservice,$Item.Id,$psPropertySet)   
  
   Foreach ($Attachment in $Message.Attachments)
   {
    $AttachmentName = $Attachment.Name
    #Write-Host "FileName: $AttachmentName"
    If ($AttachmentName -match ".jpg")
    {
     $AttachmentName
     Write-Host "FileName: $AttachmentName" -ForegroundColor green
     
     #SaveAttachment
     $Attachment.Load("C:\Temp\Spam\$AttachmentName")
    }
   }
  }
 }
 $offset = $offset + 1000
} while($Items.MoreAvailable)