$ModuleCheck = Get-Module -Name ExchangeOnlineManagement If ($ModuleCheck -eq $Null) { Write-Host "Your PowerShell session is not connected to Exchange Online." Write-Host "Please connect to Exchange Online using an administrative account and retry."; Break } Write-Host "Finding messages in quarantine" $QMessages = Get-QuarantineMessage $Report = [System.Collections.Generic.List[Object]]::new(); $Now = Get-Date ForEach ($Message in $QMessages) { $RemainingTime = (New-TimeSpan -Start $Now -End $Message.Expires) $Remaining = $RemainingTime.Days.toString() + " days " + $RemainingTime.Hours.toString() + " hours" [String]$Recipient = $Null; $i = 0 ForEach ($Address in $Message.RecipientAddress) { If ($i -eq 0) { $i++ $Recipient = $Address} Else {$Recipient = "; " + $Address } } $ReportLine = [PSCustomObject]@{ #Update with details of what we have done Identity = $Message.Identity Received = Get-Date($Message.ReceivedTime) -format g Recipient = $Recipient Sender = $Message.SenderAddress Subject = $Message.Subject SenderDomain = $Message.SenderAddress.Split("@")[1] Type = $Message.QuarantineTypes Expires = Get-Date($Message.Expires) -format g "Time Remaining" = $Remaining } $Report.Add($ReportLine) } CLS Write-Host "Type of Quarantined messages" $Report | Group Type | Sort Count -Descending | Format-Table Name, Count Write-Host "Messages quarantined per recipient address" $Report | Group Recipient | Sort Count -Descending | Format-Table Name, Count Write-Host "Problem domains" $Report | Group SenderDomain |Sort Count -Descending | Format-Table Name, Count Write-Host "High confidence Phishing Messages" $Report | ? {$_.Type -eq "HighConfPhish"} | Format-Table Received, Recipient, Sender, Subject $Report | Export-CSV -NoTypeInformation c:\temp\QuarantinedMessages.csv -Encoding UTF8