Gejala
Misalnya Anda membuat pencarian eDiscovery di tempat di Exchange Admin Center (EAC) untuk menghasilkan item yang akan dikirim ke penerima eksternal menetapkan tidak Penerima: "internalDomain" kriteria pencarian. Dalam situasi ini, sintaks pencarian mengembalikan item yang dikirim ke penerima eksternal hanya, tetapi tidak termasuk item yang memiliki penerima internal dan eksternal.
Penyebab
Masalah ini terjadi karena eDiscovery menggunakan kata kunci Query Language (KQL) yang menggunakan logika Boolean. Oleh karena itu, tidak Penerima: "internalDomain" mengecualikan semua item yang berisi penerima internal, bahkan item yang juga memiliki penerima eksternal.
Catatan Desain saat ini tidak menyediakan fungsionalitas yang lebih halus melalui EAC.
Pemecahan masalah
Untuk mengatasi masalah ini, Anda dapat menggunakan salah satu dari metode berikut ini.
Metode 1: Gunakan EWSEditor
Aplikasi EWSEditor ware gratis yang tersedia untuk mengatasi masalah ini. Ada eDiscovery jendela yang dapat digunakan untuk mencari item.
Catatan Anda harus menyiapkan akun yang digunakan untuk memiliki peran Audit RBAC untuk melakukan pencarian ini.
Metode 2: Menggunakan API berbeda
Menggunakan API lain yang mengandalkan KQL. Anda harus membangun solusi kustom menggunakan program lain, seperti Exchange Web Services (EWS). Solusi dapat mengambil beberapa bagian dari data (dataset besar). Solusi lebih proses dapat menerima hasil menggunakan eksternal logika tiba di dikehendaki set pesan yang sesuai dengan tidak Penerima: "internalDomain" kriteria Anda akan menafsirkan.
Selain itu, identifikasi pesan tersebut maju, solusi yang lebih baik akan menggunakan aturan transpor yang dapat Anda kirimkan salinan item seperti (internal dan eksternal Penerima) untuk pesan audit.
Berikut ini adalah contoh kode untuk mengatasi masalah ini dengan menggunakan EWS Managed API.
Catatan Dalam contoh kode ini, ganti InternalDomain1.com, InternalDomain2.com, InternalDomain3.com dengan nama internal domain. Tempat ini ditampilkan di tiga lokasi di dalam kode.
<#AQS search using EWS Managed API
USAGE: .\Search-Mailbox.ps1 -MailboxName mbx@domain.com -AqsString "(""Test"")"
#>
[CmdletBinding()]
param (
[Parameter(Position=0,Mandatory=$True,HelpMessage="Mailbox SMTP format")]
[ValidateNotNullOrEmpty()]
[string]$MailboxName,
[Parameter(Position=1,Mandatory=$True,HelpMessage="AQS QueryString")]
[ValidateNotNullOrEmpty()]
[string]$AqsString
)
#######################################################################
# Update EWS DLL Folder,$domain, $account, $pwd and $exserver Values
########################################################################
$resultFL = "C:\Scripts\Result"
$domain = "SEARCH"
$account = "MailboxSearch@domain.com";$pwd = '123'
$exServer = "exch01search.net"
$EWSManagedApiPath = "C:\scripts\Microsoft.Exchange.WebServices.dll"
########################################################################
$LogFile_All = "$($resultFL)\$($Mailboxname)_All.txt"
$LogFile_Filtr = "$($resultFL)\$($Mailboxname)_Filtered.txt"
$LogFile_Itype = "$($resultFL)\$($Mailboxname)_ItemTypes.txt"
$StopWatch = New-Object system.Diagnostics.Stopwatch
$StopWatch.Start()
Add-Type -Path $EWSManagedApiPath
$service = New-Object Microsoft.Exchange.WebServices.Data.ExchangeService([Microsoft.Exchange.WebServices.Data.ExchangeVersion]::Exchange2010_SP2)
$service.Credentials= new-object Microsoft.Exchange.WebServices.Data.WebCredentials($account,$pwd,$domain)
$service.UseDefaultCredentials = $false
$UseAutoDiscover = $false
$service.Url = new-object uri("https://domain.com/EWS/Exchange.asmx")
$ImpersonatedUserId = new-object Microsoft.Exchange.WebServices.Data.ImpersonatedUserId([Microsoft.Exchange.WebServices.Data.ConnectingIdType]::SmtpAddress,$MailboxName);
$service.ImpersonatedUserId = $ImpersonatedUserId
#Define Extended properties
$PR_Folder_Path= new-object Microsoft.Exchange.WebServices.Data.ExtendedPropertyDefinition(26293, [Microsoft.Exchange.WebServices.Data.MapiPropertyType]::String);
$PR_FOLDER_TYPE = new-object Microsoft.Exchange.WebServices.Data.ExtendedPropertyDefinition(13825,[Microsoft.Exchange.WebServices.Data.MapiPropertyType]::Integer);
$folderidcnt = new-object Microsoft.Exchange.WebServices.Data.FolderId([Microsoft.Exchange.WebServices.Data.WellKnownFolderName]::MsgFolderRoot,$MailboxName)
#Define the FolderView used for Export should not be any larger then 1000 folders due to throttling
$fvFolderView = New-Object Microsoft.Exchange.WebServices.Data.FolderView(1000)
#Deep Transval will ensure all folders in the search path are returned
$fvFolderView.Traversal = [Microsoft.Exchange.WebServices.Data.FolderTraversal]::Deep;
$pSchPropSet= new-object Microsoft.Exchange.WebServices.Data.PropertySet([Microsoft.Exchange.WebServices.Data.BasePropertySet]::FirstClassProperties)
$pSchPropSet.Add($PR_Folder_Path)
$fvFolderView.PropertySet = $pSchPropSet
#The Search filter will exclude any Search Folders
$sfSearchFilter = new-object Microsoft.Exchange.WebServices.Data.SearchFilter+IsEqualTo($PR_FOLDER_TYPE,"1")
$fiResult = $null
$MsgPropSet = New-Object Microsoft.Exchange.WebServices.Data.PropertySet
$MsgPropSet.Add([Microsoft.Exchange.WebServices.Data.ItemSchema]::Id)
$MsgPropSet.Add([Microsoft.Exchange.WebServices.Data.ItemSchema]::ParentFolderId)
$MsgPropSet.Add([Microsoft.Exchange.WebServices.Data.ItemSchema]::ItemClass)
$MsgPropSet.Add([Microsoft.Exchange.WebServices.Data.ItemSchema]::Subject)
$MsgPropSet.Add([Microsoft.Exchange.WebServices.Data.ItemSchema]::DateTimeSent)
$MsgPropSet.Add([Microsoft.Exchange.WebServices.Data.EmailMessageSchema]::Sender)
$MsgPropSet.Add([Microsoft.Exchange.WebServices.Data.EmailMessageSchema]::ToRecipients)
$MsgPropSet.Add([Microsoft.Exchange.WebServices.Data.EmailMessageSchema]::ccRecipients)
$MsgPropSet.Add([Microsoft.Exchange.WebServices.Data.EmailMessageSchema]::BccRecipients)
$AptPropSet = New-Object Microsoft.Exchange.WebServices.Data.PropertySet
$AptPropSet.Add([Microsoft.Exchange.WebServices.Data.ItemSchema]::Id)
$AptPropSet.Add([Microsoft.Exchange.WebServices.Data.ItemSchema]::ParentFolderId)
$AptPropSet.Add([Microsoft.Exchange.WebServices.Data.ItemSchema]::ItemClass)
$AptPropSet.Add([Microsoft.Exchange.WebServices.Data.ItemSchema]::Subject)
$AptPropSet.Add([Microsoft.Exchange.WebServices.Data.ItemSchema]::DateTimeSent)
$AptPropSet.Add([Microsoft.Exchange.WebServices.Data.AppointmentSchema]::Organizer)
$AptPropSet.Add([Microsoft.Exchange.WebServices.Data.AppointmentSchema]::RequiredAttendees)
$AptPropSet.Add([Microsoft.Exchange.WebServices.Data.AppointmentSchema]::OptionalAttendees)
$SchPropSet = New-Object Microsoft.Exchange.WebServices.Data.PropertySet
$SchPropSet.Add([Microsoft.Exchange.WebServices.Data.ItemSchema]::Id)
$SchPropSet.Add([Microsoft.Exchange.WebServices.Data.ItemSchema]::ParentFolderId)
$SchPropSet.Add([Microsoft.Exchange.WebServices.Data.ItemSchema]::ItemClass)
$SchPropSet.Add([Microsoft.Exchange.WebServices.Data.ItemSchema]::Subject)
$SchPropSet.Add([Microsoft.Exchange.WebServices.Data.ItemSchema]::DateTimeSent)
$SchPropSet.Add([Microsoft.Exchange.WebServices.Data.MeetingRequestSchema]::Organizer)
$SchPropSet.Add([Microsoft.Exchange.WebServices.Data.MeetingRequestSchema]::RequiredAttendees)
$SchPropSet.Add([Microsoft.Exchange.WebServices.Data.MeetingRequestSchema]::OptionalAttendees)
#Write-host "Checking Mailbox: $($MailboxName)"
#Write-host "Searching QueryString: $($AqsString)"
#The Do loop will handle any paging that is required if there are more the 1000 folders in a mailbox
$ic=0
$fic=0
do {
$fiResult = $Service.FindFolders($folderidcnt,$sfSearchFilter,$fvFolderView)
#$fiResult.Folders.Count
foreach($ffFolder in $fiResult.Folders){
# "Processing : " + $ffFolder.displayName
$fpath = $ffFolder.ExtendedProperties[0].Value
$fic++
$fiItems = $null
$ItemView = New-Object Microsoft.Exchange.WebServices.Data.ItemView(1000)
do{
Write-Progress -Activity "Processing $($MailboxName) - QueryString $($AqsString)" -Status $ffFolder.DisplayName -PercentComplete ($fic/$fiResult.Folders.Count*100)
$fiItems = $ffFolder.findItems($AqsString,$ItemView)
$ic = $ic + $fiItems.items.count
$ItemView.offset += $fiItems.Items.Count
foreach($Item in $fiItems.Items){
$itype = "$($item.ItemClass)`t$($Item.id.UniqueId)"
Add-content -Value $itype -Path $LogFile_Itype
$result=""
switch ($item.ItemClass)
{
"IPM.Note" {
$Item.Load($MsgPropSet)
$MT = @() # Create a MAPITABLE to filter external Domains
$eRecipients=""
$result = "$($mailboxname)`t$($fpath)`t$($Item.Sender.Name)`t$($Item.DateTimeSent)`t$($Item.Subject)`t$($Item.id.UniqueId)`t$($item.ItemClass)"
Add-content -Value $result -Path $LogFile_All
$item.ToRecipients | %{If($_.RoutingType -ne "EX"){$mt+=$_.Address
}} $item.ccRecipients | %{If($_.RoutingType -ne "EX"){$mt+=$_.Address}} $item.BccRecipients | %{If($_.RoutingType -ne "EX"){$mt+=$_.Address}} $er=@()<#Replace InternalDomain1.com, InternalDomain2.com, InternalDomain3.com with your internal domain name.#>
$mt | %{if($_ -notmatch 'InternalDomain1.com|InternalDomain2.com|InternalDomain3.com'){
$eRecipients = $true
$er +=$_
}
}
}
"IPM.Appointment" {
$Item.Load($AptPropSet)
$MT = @() # Create a MAPITABLE to filter external Domains
$eRecipients=""
$result = "$($mailboxname)`t$($fpath)`t$($Item.Organizer.Name)`t$($Item.DateTimeSent)`t$($Item.Subject)`t$($Item.id.UniqueId)`t$($item.ItemClass)"
Add-content -Value $result -Path $LogFile_All
$item.RequiredAttendees | %{If($_.RoutingType -ne "EX"){$mt+=$_.Address
}} $item.OptionalAttendees | %{If($_.RoutingType -ne "EX"){$mt+=$_.Address}} $er=@() <#Replace InternalDomain1.com, InternalDomain2.com, and InternalDomain3.com with your internal domain name.#>
$mt | %{if($_ -notmatch 'InternalDomain1.com|InternalDomain2.com|InternalDomain3.com'){
$eRecipients = $true
$er +=$_
}
}
}
"IPM.Schedule.Meeting.Request" {
$Item.Load($SchPropSet)
$MT = @() # Create a MAPITABLE to filter external Domains
$eRecipients=""
$result = "$($mailboxname)`t$($fpath)`t$($Item.Organizer.Name)`t$($Item.DateTimeSent)`t$($Item.Subject)`t$($Item.id.UniqueId)`t$($item.ItemClass)"
Add-content -Value $result -Path $LogFile_All
$item.RequiredAttendees | %{If($_.RoutingType -ne "EX"){$mt+=$_.Address
}} $item.OptionalAttendees | %{If($_.RoutingType -ne "EX"){$mt+=$_.Address}} $er=@()<#Replace InternalDomain1.com, InternalDomain2.com, InternalDomain3.com with your internal domain.#>
$mt | %{if($_ -notmatch 'InternalDomain1.com|InternalDomain2.com|InternalDomain3.com'){
$eRecipients = $true
$er +=$_
}
}
}
Default {$eRecipients="";$result=""}
} #END Switch
If($eRecipients){
$er = $er -join ";"
$result="$($result)`t$($er)"
Add-content -Value $result -Path $LogFile_Filtr
}
} #End Foreach Items
}while($fiItems.MoreAvailable -eq $true)
} #End Foreach Folders
$fvFolderView.Offset += $fiResult.Folders.Count
}while($fiResult.MoreAvailable -eq $true)
$StopWatch.Stop()
write-host "Completed $($Mailboxname) in Seconds:" $StopWatch.Elapsed.TotalSeconds -ForegroundColor Green
Write-Host "Total Items found:" $ic
$StopWatch = $null
Metode 3: Pencegahan pemantauanIdentifikasi item yang memiliki penerima internal dan eksternal, buat aturan transpor yang dapat mengirim salinan item tersebut ke pesan audit.
Status
Microsoft telah mengkonfirmasi bahwa ini merupakan bagian dari rancangan.
Informasi lebih lanjut
Untuk informasi selengkapnya tentang eDiscovery di tempat, kunjungi website Microsoft berikut:
Informasi umum tentang di tempat eDiscoveryUntuk informasi selengkapnya tentang KQL, kunjungi situs web Microsoft berikut:
