发邮件记录-----
Get-TransportServer | Get-MessageTrackingLog -Sender:[email protected] -EventId send -Start "2017-08-07 08:38" -End "2017-08-07 08:45" | Select-Object Timestamp,ClientIp,ClientHostname,ServerIp,ServerHostname,connectorid,Source,EventId,{$.recipients},{$.RecipientStatus},TotalBytes,RecipientCount,MessageSubject,Sender | Export-Csv -Path d:\exlog_sender_2017011301.csv -Encoding Unicode -NoTypeInformation
收邮件记录------
Get-TransportServer | Get-MessageTrackingLog -Recipients:[email protected] -EventId send -Start 2016-12-01 | Select-Object Timestamp,ClientIp,ClientHostname,ServerIp,ServerHostname,connectorid,Source,EventId,{$.recipients},{$.RecipientStatus},TotalBytes,RecipientCount,MessageSubject,Sender | Export-Csv -Path d:\exlog_recipients_2017011301.csv -Encoding Unicode -NoTypeInformation
Get-Mailbox -Identity "590031i" | Ft Alias, Database
ExChange Shell API文档
https://docs.microsoft.com/en-us/powershell/module/exchange/mailbox-databases-and-servers/get-mailboxdatabase?view=exchange-ps
查看服务器集群的名字及版本信息
Get-ExchangeServer | Ft Name, ServerRole, Edition, AdminDisplayVersion -auto
获取DB列表及所在服务器信息
Get-MailboxDatabase | Format-List
查询MBX03_New DB所在的服务器信息
Get-MailboxDatabase -Identity MBX03_New | Format-List
查看某用户使用邮箱大小及所在DB情况
Get-Mailbox -Identity [email protected] | Get-MailboxStatistics | select DisplayName,TotalItemSize,Database
查询队列使用情况
Get-Queue
查看邮箱使用容量
get-mailboxstatistics -identity 590031i | format-list
get-mailboxstatistics -identity 590031i | ft displayname,totalitemsize,lastlogontime
查看ExchangeServer版本
Get-exchangeserver | format-list name,edition,admindisplayversion
删除某用户某时间段内邮件内容
Search-Mailbox -Identity "[email protected]" -SearchQuery "Received:01/01/2017..07/20/2017" -DeleteContent
1，按邮件主题删除特定用户特定邮件：
以下示例为删除用户sky里的邮件主题含有'Product Discussion'关键字的邮件。
Search-Mailbox -Identity "sky" -SearchQuery "Subject:'Product Discussion'" -DeleteContent
按内容关键字删除特定用户特定邮件：
以下示例为删除用户sky里的邮件内容里含有为Modify my alert settings的邮件。（因为sharepoint里更换发信人只是最近一个月的事，以前的sharepoint邮件要进行更仔细的甄别。）
Search-Mailbox -Identity "sky" -SearchQuery "body:'Modify my alert settings'" -DeleteContent
검색된 메일을 삭제 (from 값이 [email protected]인 메일)
- Get-Mailbox -Resultsize Unlimited | Search-Mailbox -SearchQuery 'from:"[email protected]"' -DeleteContent
1. 메일 삭제 전 사용자 조회（电子邮件删除前用户查询）
Get-Mailbox -ResultSize unlimited | Search-Mailbox -SearchQuery 'Subject:"离职感言"' -EstimateResultOnly | Measure-Object
2. 메일 삭제（删除邮件）
Get-Mailbox -ResultSize unlimited | Search-Mailbox -SearchQuery ' Subject:"离职感言"' -DeleteContent
3. 삭제 후 사용자 조회 （删除后用户查询）
Get-Mailbox -ResultSize unlimited | Search-Mailbox -SearchQuery ' Subject:"离职感言"' -EstimateResultOnly | Measure-Object