O365邮箱规则收集-自动脚本

时间:2019-12-03 18:57:39

标签: outlook o365security-compliance

采取一些与O365数据收集相关的非常基本的PS命令,然后尝试将它们合并为一个脚本。问题是,如果每个命令都在PS命令行上单独运行,则不会有问题,但是一旦将它们组合成脚本,就会产生大量错误。任何建议或指示将不胜感激。

$UserCredential = Get-Credential
$GlobalAdmin = Read-Host "Enter the account name of the global admin. (Eg: admin@domain.com)"
Connect-EXOPSSession -UserPrincipalName $GlobalAdmin

Do
{
    $PersonofInterest = Read-Host "Enter the account name of the compromised account"
    mkdir .\InboxRules

    #Details of the rules
    $mailboxes = get-mailbox –exitScriptize unlimited
    $rules = $mailboxes | foreach { get-inboxRule –mailbox $_.alias }
    $rules | ft name,identity,ruleidentity > .\InboxRules\rulesoutput.csv
    echo "RulesOutput.csv has been successfully captured."

    #Details of the Forwarding and Redirect Flags
    $rules | where { ( $_.forwardAsAttachmentTo –ne $NULL  ) –or ( $_.forwardTo –ne $NULL ) –or ( $_.redirectTo –ne $NULL ) } | ft name,identity,ruleidentity > .\InboxRules\Forwarding_RedirectFlags.csv
    echo "Forwarding_RedirectFlags.csv has been successfully captured."

    #Forwarding SMTP address
    $mailboxes | where { $_.forwardingSMTPAddress –ne $NULL } | Select * > .\InboxRules\SMTPForwarding.csv
    echo "SMTPForwarding.csv has been successfully captured."

    #All Rules for Compromised Individual
    Get-InboxRule -Mailbox $PersonofInterest > ".\InboxRules\$PersonofInterest-MailboxRules.csv"
    echo "$PersonofInterest.MailboxRules.csv has successfully been captured."

    #Auditing Info
    Get-Mailbox -Identity $PersonofInterest | Select-Object -ExpandProperty AuditOwner > .\InboxRules\AuditOwner.csv
    Get-Mailbox -Identity $PersonofInterest | Select-Object -ExpandProperty AuditDelegate > .\InboxRules\AuditDelegate.csv
    Get-Mailbox -Identity $PersonofInterest | Select-Object -ExpandProperty AuditAdmin > .\InboxRules\AuditAdmin.csv
    echo "Audit Owner, Delegate and Admin have all been captured successfully."

    Clear-Variable -Name "PersonofInterest"

    $exitScript = Read-Host "End script? (yes or no)"

} While($exitScript -ne "yes" -or $exitScript -ne "Yes" -or $exitScript -ne "Y" -or $exitScript -ne "y")

Get-PSSession | Remove-PSSession

错误:

 At C:\Users\XXX\Desktop\Scripts\O365\Testing\InboxRules.ps1:25 char:69
+ ...   $rules = $mailboxes | foreach { get-inboxRule –mailbox $_.alias }
+                                                                          ~
Missing while or until keyword in do loop.
At C:\Users\XXX\Desktop\Scripts\O365\Testing\InboxRules.ps1:30 char:46
+ ... les | where { ( $_.forwardAsAttachmentTo –ne $NULL  ) –or ( $_.fo ...
+                                              ~~~~~~~~~~~~~~~~~~~~
Unexpected token '–ne $NULL  ) –or' in expression or statement.
At C:\Users\XXX\Desktop\Scripts\O365\Testing\InboxRules.ps1:30 char:45
+     $rules | where { ( $_.forwardAsAttachmentTo –ne $NULL  ) –or  ...
+                                                ~
Missing closing ')' in expression.
At C:\Users\XXX\Desktop\Scripts\O365\Testing\InboxRules.ps1:30 char:82
+ ... entTo –ne $NULL  ) –or ( $_.forwardTo –ne $NULL ) –or ( $_.re ...
+                                               ~~~~~~~~~~~~~~~~~~~
Unexpected token '–ne $NULL ) –or' in expression or statement.
At C:\Users\XXX\Desktop\Scripts\O365\Testing\InboxRules.ps1:30 char:81
+ ...  $_.forwardAsAttachmentTo –ne $NULL  ) –or ( $_.forwardTo –ne $ ...
+                                                                  ~
Missing closing ')' in expression.
At C:\Users\XXX\Desktop\Scripts\O365\Testing\InboxRules.ps1:30 char:118
+ ... .redirectTo –ne $NULL ) } | ft name,identity,ruleidentity > .\Inbox ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Unexpected token '–ne $NULL ) } | ft name,identity,ruleidentity > .\InboxRules\Forwarding_RedirectFlags.csv
        echo "Forwarding_RedirectFlags.csv' in expression or statement.
At C:\Users\XXX\Desktop\Scripts\O365\Testing\InboxRules.ps1:30 char:117
+ ... L  ) –or ( $_.forwardTo –ne $NULL ) –or ( $_.redirectTo –ne $ ...
+                                                                  ~
Missing closing ')' in expression.
At C:\Users\XXX\Desktop\Scripts\O365\Testing\InboxRules.ps1:51 char:1
+ } While($exitScript -ne "yes" -or $exitScript -ne "Yes" -or $exitScri ...
+ ~
Unexpected token '}' in expression or statement.
At C:\Users\XXX\Desktop\Scripts\O365\Testing\InboxRules.ps1:51 char:105
+ ... exitScript -ne "Yes" -or $exitScript -ne "Y" -or $exitScript -ne "y")
+                                                                          ~
Missing statement body in while loop.
    + CategoryInfo          : ParserError: (:) [], ParseException
    + FullyQualifiedErrorId : MissingWhileOrUntilInDoWhile

0 个答案:

没有答案