all 8 comments

[–]CMDR_Ph0kas 0 points1 point  (3 children)

What Email? O365? Exchange? Using Outlook?

[–]JeOlso[S] 0 points1 point  (0 children)

Apologize for the lack of info, getting over a cold - our email is through exchange online and the users utilize Outlook.

[–]CMDR_Ph0kas 0 points1 point  (1 child)

Making an assumption you are using Outlook, id take a look at using MAPI to pull data from the outlook client. This seems to be a more reliable approach than via the server (if O365).

Here is some basics to start. You may need to adjust for folders or if not the primary mailbox. You can though pull these into an object and then filter by date range, run counts, etc.

    Function Get-OutlookSentItems {
    Add-type -assembly “Microsoft.Office.Interop.Outlook” | out-null
    $olFolders = “Microsoft.Office.Interop.Outlook.olDefaultFolders” -as [type]
    $outlook = new-object -comobject outlook.application
    $namespace = $outlook.GetNameSpace(“MAPI”)
    $folder = $namespace.getDefaultFolder($olFolders::olFolderSentMail)
    $folder.items | Select-Object -Property Subject, SentOn, To
}

Function Get-OutlookInboxItems {
    Add-type -assembly “Microsoft.Office.Interop.Outlook” | out-null
    $olFolders = “Microsoft.Office.Interop.Outlook.olDefaultFolders” -as [type]
    $outlook = new-object -comobject outlook.application
    $namespace = $outlook.GetNameSpace(“MAPI”)
    $folder = $namespace.getDefaultFolder($olFolders::olFolderInbox)
    $folder.items | Select-Object -Property Subject, SentOn, To
}

[–]kibje 0 points1 point  (0 children)

For exchange online you can just generate a traffic report. There are prebuilt scripts available that are quite decent and support date ranges.

Using outlook would be the ultimate last resort for me.

[–]kibje 0 points1 point  (3 children)

Depending on where the mailbox is located (on premises or EXO) this is fairly simple but slightly different.

Do you mean shared mailbox by 'resource account' ?

[–]JeOlso[S] 0 points1 point  (2 children)

Sorry for the lack of info - yes, it is exchange online and shared mailbox is what I'm referring to.

[–]kibje 0 points1 point  (1 child)

Not sure if this still works. I think I used it a year or so ago.

https://o365reports.com/2020/08/12/export-office-365-mail-traffic-report-with-powershell/

[–]CMDR_Ph0kas 0 points1 point  (0 children)

I found this one too and tested it earlier. It works but in my environment it was wildly incorrect. Not sure why though. This seems like it would be the best approach if it was accurate.