Audit Mail Contacts 3

[theravager]

Morning all,

Anyone know any easy way or have a script to audit which mail contacts haven't been used for a certain period. I have a company that has been made out of a dozen smaller companies that have all been merged and I am looking for a way to dump what is most likely hundreds of mail contacts that are probably no longer required.

Be nice if someone had a script to verify if the addresses are even valid any more to.

Cheers

 

[ShackDaddy]

This is going to be hard to come up with, since there isn't really any tracking of object access that can tell you whether a contact has been used. It's kind of like the phone company not knowing which phone book entries have been used to make calls. Calls could have been made without using the phone book, the only thing they can do is make sure that the entries are valid.

When I think of what your resources might be, I can only think of the logs that outbound delivery generated. Since the tracking logs have a short shelf life, there's the SMTP logs and any logs that your mail hygiene might keep, but none of those are going to be easy to use to dump addresses and match them with contacts.

One option would be to delete any contacts that aren't currently used by distribution lists or forwarding rules in the organization, and let them regenerate. Since users also have NK2 files that store information about the people they mail, they may not always need the contacts. Remember though that some of the distro lists are personal ones stored in Outlook and not as formal Exchange distro lists.

Dave Shackelford
ThirdTier.net
TrainSignal.com

 

[58sniper]

What I've done in the past to accomplish this is change the tracking log retention time to something really long. This requires adequate storage.

Then, I build an array of the SMTP addresses in the contacts, then search through the tracking logs to see if there is a match for each. This is VERY time consuming from a script execution perspective. Then - for each SMTP address that does NOT appear in the tracking logs, I know that the contact was NOT used to send mail.

Below is a copy that I wrote for Exchange 2007. Run it and it will display which contacts it would delete. If it meets your requirements, seach for the line

Remove-MailContact $contact.displayname -whatif

and remove the -WhatIf at the end.

No warranty here, folks. But let me know if it works for you.

#############################################################################
# Kill-Contacts.ps1
# Deletes any contact that hasn't been used in the last x days
#
# Pat Richard, Exchange MVP
# [URL unfurl="true"]http://www.ehloworld.com/[/URL]
# 
# RIGHTS REQUIRED
# ===============
# Recipient admin
# 
# UPDATES
# =======
# v1.1 - 12/09/2009 variable cleanup; event logging
# v1.0 – Original script
# 
# Dedicated blog post:
#
# Future enhancements:
# Logging to eventlog
# Email notification of deleted contacts to HelpDesk
# 
# DISCLAIMER
# ==========
# THIS CODE IS MADE AVAILABLE AS IS, WITHOUT WARRANTY OF ANY KIND. THE ENTIRE 
# RISK OF THE USE OR THE RESULTS FROM THE USE OF THIS CODE REMAINS WITH THE USER.
#############################################################################
if (-not((Get-PSSnapin) -match "Microsoft.Exchange.Management.PowerShell.Admin")){	Add-PSSnapin Microsoft.Exchange.Management.PowerShell.Admin }
$strLogEachUser = $true
# option to surpress screen output
$strScriptName = $MyInvocation.MyCommand.Name
$evt = new-object System.Diagnostics.EventLog("Application")
$evt.Source = $strScriptName
$infoevent = [System.Diagnostics.EventLogEntryType]::Information
$strEventLogText = "Beginning processing."
$evt.WriteEntry($strEventLogText,$infoevent,70)

$OldestLogs = (Get-TransportServer $env:ComputerName).MessageTrackingLogMaxAge.Days
$Start = (Get-Date).AddDays(-$OldestLogs)

$total2bwacked = 0
$Contacts = Get-Contact | Sort-Object DisplayName
cls
% ($contact in $contacts){
	write-host "Checking " $contact.DisplayName " ("$contact.WindowsEmailAddress") " -nonewline
 	$mylog = @(Get-MessageTrackingLog -Eventid receive -Recipients $contact.WindowsEmailAddress -start $start)
	if ($mylog.length -eq 0){
		Write-Host $mylog.length -foregroundcolor red
		Remove-MailContact $contact.displayname -whatif
		if($strLogEachUser){
	  		$strEventLogText = "Contact deleted for $Contact.DisplayName ($Contact.WindowsEmailAddress)"
    			$evt.WriteEntry($strEventLogText,$infoevent,70)
		}
		$total2bwacked++
	}else{
		Write-Host $mylog.length -foregroundcolor green
	}
}
write-host "Total: $total2bwacked"
# notify HelpDesk

$strEventLogText = "Finished processing $total2bwhacked contacts."
$evt.WriteEntry($strEventLogText,$infoevent,70)

Do you have your Tek-Tips.com Swag? I've got mine!

Stop by the new Tek-Tips group at LinkedIn.

 

[ShackDaddy]

Very nice! But I guess you'd want to allow tracking logs to accumulate for a month or more before running this.

Dave Shackelford
ThirdTier.net
TrainSignal.com

 

[58sniper]

Yeah - it reads what it's set to, and then uses that. But it doesn't actually check to see that there are physical log files going back that far.

I should update it, although I didn't think there would be much call for that script. I merely wrote it to fullfil a need I had during a migration.

Do you have your Tek-Tips.com Swag? I've got mine!

Stop by the new Tek-Tips group at LinkedIn.

 

[theravager]

Exactly what i was looking for.

Cheers