Running an Office 365 Compliance Search using Powershell

Overview

Running a Content Search is fairly easy from within the Office 365 Security & Compliance Center but sometimes it will make sense to drop down into Powershell to run more complex queries.

Here are links to some of the more useful articles on this subject:

To build a query you will need to use KQL. Here is a good article on the syntax:
https://technet.microsoft.com/en-us/library/ms.exch.eac.searchquerylearnmore(v=exchg.150).aspx

NOTE: The Technote refers to AND and OR logical operators but in Powershell you have to use (c:c) for AND and (c:s) for OR.

Running a Complex Query in Powershell

Here is a script I wrote to run a more complex query when we had to search for a list of hundreds of document attachments within Office 365 for a Client.

NOTE: There is a limitation of the number of characters that can be in the query. No error is thrown if you run the script, it just returns incorrect results. That threw me off for a while, but if you edit the script from the Security & Compliance Center you will get an error

The property is too long. The maximum length is 16384 and the length of the value provided is 23966.

So we had to split up the query into several blocks to not exceed this limit of 16384 characters.

Deleting an Email using the Search & Compliance Center

This link describes how to delete an email message using the Search & Compliance Center:

https://support.office.com/en-us/article/Search-for-and-delete-email-messages-in-your-Office-365-organization-Admin-Help-3526fd06-b45f-445b-aed4-5ebd37b3762a

Example:

New-ComplianceSearch -Name "TestRemoveMessage" -ExchangeLocation All -ContentMatchQuery "subject:'This is a test' (c:c) From:'pschwarz@syndeotech.com'" New-ComplianceSearchAction -SearchName "TestRemoveMessage" -Purge -PurgeType SoftDelete

Replace SoftDelete with HardDelete to get rid of the message altogether (does not even show up in Deleted Items).

 

 

TIP How to Configure Email Notification for Windows Server Backup

Although it does not replace enterprise grade backups systems like Veeam or StorageCraft, Windows Server Backup works quite well for basic backup tasks. But it lacks any notification system on the progress of the backups. Here are two simple ways to set that up. First, this option uses the Event Viewer task:

Configure Email Notification for Windows Server Backup

And here is a more advanced and flexible approach using Powershell:

Email Notifications with Windows Server Backup

 

 

TIP Fix Office 365 ProPlus Error a shared computer license isn’t available

This is error (or similar) can pop up on a Windows 2012 R2 RD Server farm.

All Technotes I found only referred to Office 15.0 (2013) not 16.0 (2016), which has a different Registry key.
Solution
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration\
Create String Value
SharedComputerLicensing = 1
IMPORTANT: Make sure it is a String Value!

Using Saved Credentials in a Powershell Script

Purpose

Credentials stored in plain text format in a Powershell script is a security issue that needs to be avoided. This Technote describes a way to save the password in a file as a secure string which can be read back into a script for authentication.

Procedure

Check out this great post on this subject.

https://blog.kloud.com.au/2016/04/21/using-saved-credentials-securely-in-powershell-scripts/

Using Google Drive as a Corporate Knowledge Base

Drive

The main reason why Google Drive works so well as a Corporate Knowledge Base is because of the world class search functionality that comes along with anything Google. Posting articles is easy, just drag them into the appropriate folder, or use Google Docs to create them directly in the desired location using almost any mobile device. I prefer a simple folder structure, in fact, you may want to consider no folder structure at all and rely totally on search to find things. That has worked great for me for years with Gmail.

There are even some advanced search options you can read about here that can be useful. If you insist on structuring your documents rather than relying on search there are Third Party tools such as Collavate (I have never used it, but it looks like Collavate provides a lot of features to put structure into your Google Drive).

Also, there are free tools available out there to expand the functionality of Google Apps. One that I installed recently is a tool to send Emails as a PDF to a folder on Google Drive. This will allow users to save information from an email to the Knowledge Base with ease (a LOT of Corporate Knowledge is lost in the bowls of your mail server because it is not shared). Here is how:

  1. Click here to copy the Save Email as PDF Google Sheet into your Google Drive
  2. Change cell D4 from “PDF” to “KB”
  3. Click on “Step 1 – Authorize” under Save PDF. You will be prompted to authorize the script to perform certain tasks.
  4. Click on “Step 2 – Run Program” to start the script (NOTE: You can stop it any time by selecting Step 2 again).
  5. You can now close the Sheet. The script will run in the background.
  6. Create a new label called “KB” (Outlook users: Create a folder called “KB”)
  7. Now when you want to add an email to the folder:
    1. Using Google Mail:. Check off the emails you want to post and select Label->KB
    2. Using Outlook: Copy the email into the folder “KB”
    3. Posting a new email to the KB using Google Mail. Select Label->KB from the bottom right of the new email.

For more information on the Save Email as PDF script and many other useful tools look here.