【O365 PowerShell Script】郵件跟蹤報告

#O365有兩種郵件跟蹤報告：
#1.一種爲快速報告（導出沒有延遲），對應命令爲get-messagetrace及get-messagetracedetail
#2.第二種爲延遲細節報告（通常有1小時延遲，可是會更加細節），對應命令爲get-historicalsearch

#如下腳本可使用PowerShell導出比較直觀的快速報告，和GUI類似，適合服務器運維按期導出報告使用

#O365 There are two types of mail tracking reports:
#1. One is for quick reports (no delay in export), and the corresponding commands are get-messagetrace and get-messagetracedetail
#2. The second type is the delayed detail report (usually there is a 1 hour delay, but it will be more detailed), and the corresponding command is get-historicalsearch

#The following script can use PowerShell to export more intuitive and fast reports, similar to GUI, suitable for server operation and maintenance to export reports regularly

#The below part needs to be modified
#如下部分須要更改
$startdate = 07/25/2020
$endDate = 07/26/2020
$CSV = "C:\Users\tonylin\AppData\Local\Microsoft\Outlook\test.csv"
#===============================================================================

#No need to modify below parts
#如下部分無需更改
$results = @()

$page = 1

While (get-messagetrace -StartDate $startdate -EndDate $endDate -pagesize 5000 -page $page) 
{
    $MessageTrace = get-messagetrace -StartDate $startdate -EndDate $endDate -pagesize 5000 -page $page
    $page++

    foreach($Trace in $MessageTrace)
    {
        $MessageDetail = get-messagetracedetail -MessageTraceId $Trace.messagetraceid.guid -recipientaddress $trace.recipientaddress

        foreach($detail in $MessageDetail)
        {
            $data = (($detail.data).split("/><") | where-object {$_ -like "*return*"})
            if($data)
            {

                $return_path = $data.split('"')[3]

                if($return_path -eq "<>")
                {
                    $return_path = "<>"
                }
            }else{
                $return_path = ""
            }

            $results += New-Object PSObject -property @{ 
                    MessageId = $detail.messageid
                    Date = $detail.Date
                    Event = $detail.Event
                    Action = $detail.Action
                    Detail = $detail.Detail
                    Data = $detail.Data
                    SenderAddress = $Trace.senderaddress
                    RecipientAddress = $Trace.RecipientAddress
                    ReturnPath = $return_path
                    }
        }
    }
}

$results |select MessageId,Date,Event,Action,Detail,Data,SenderAddress,RecipientAddress,ReturnPath | export-csv $CSV -notypeinformation -encoding utf8