<img src="//bat.bing.com/action/0?ti=5794969&amp;Ver=2" height="0" width="0" style="display:none; visibility: hidden;">

How to Recover Email Retention Policy Settings in Microsoft Office 365

[fa icon="long-arrow-left"] Back to all posts

[fa icon="pencil'] Posted by John Certeza [fa icon="calendar"] August 28, 2015


One of our clients recently migrated their email from Microsoft Exchange to Microsoft Office 365 and after the fact realized they hadn't migrated their employee retention policy settings. We were unsure of which users had a one year retention policy or two year retention policy.

The good news is, this information isn't totally lost.

Retention limits can still be retrieved in Office 365 (and Exchange 2013) by using the command Get-MailboxFolderStatistics and its parameter IncludeOldestAndNewestItems to determine the age of items in a mailbox. From here you can figure out which users have old items in their mailboxes that correlate to a longer retention policy (in this case we are looking for people with a policy longer than one year).

To start, let's take a user and pull the oldest items in their folders:

Get-MailboxFolderStatistics -Identity user1 -IncludeOldestAndNewestItems | ft identity,OldestItemReceivedDate -AutoSize

Identity                             OldestItemReceivedDate
--------                             ----------------------
user1\Top of Information Store
user1\Contacts                       7/5/2013 6:15:13 PM
user1\Deleted Items
user1\Drafts                         8/17/2014 7:21:25 AM
user1\Inbox                          8/17/2014 3:21:21 AM

and many more folders ...

This command pulls too much data so we'll filter it to the two most common folders (Inbox and Sent Items). Also, we know that retention policies were applied to the Inbox and Sent Items so our statistics will correlate. 

Get-MailboxFolderStatistics -Identity user1 -IncludeOldestAndNewestItems -FolderScope "Inbox" | Where {$_.FolderPath -eq "/Inbox"} | ft identity,OldestItemReceivedDate -AutoSize
Identity           OldestItemReceivedDate
--------           ----------------------
user1\Inbox        8/17/2014 3:21:21 AM

Get-MailboxFolderStatistics -Identity user1 -IncludeOldestAndNewestItems -FolderScope "SentItems" | Where {$_.FolderPath -eq "/Sent Items"} | ft identity,OldestItemReceivedDate -AutoSize
Identity                OldestItemReceivedDate
--------                ----------------------
user1\Sent Items        8/17/2014 3:25:00 AM

Now that we have figured out how to get the oldest item in the Inbox and Sent Items for a user, let's expand the query to all mailboxes.  We will get all mailboxes that have a UserPrincipalName that contains "@company.com" and pipe that into each folder query:

Get-Mailbox -Filter {UserPrincipalName -like "*@company.com"} -ResultSize unlimited | Get-MailboxFolderStatistics -IncludeOldestAndNewestItems -FolderScope "Inbox" | Where {$_.FolderPath -eq "/Inbox"} | ft identity,OldestItemReceivedDate -AutoSize


Get-Mailbox -Filter {UserPrincipalName -like "*@company.com"} -ResultSize unlimited |  Get-MailboxFolderStatistics -Identity user1 -IncludeOldestAndNewestItems -FolderScope "Inbox" | Where {$_.FolderPath -eq "/Inbox"} | ft folderpath,OldestItemReceivedDate -AutoSize

These queries respectively produce this output (which I pasted into Excel and sorted by date for ease of reading):

Identity               OldestItemReceivedDate
--------               ----------------------
James Smith\Inbox      5/18/2013 0:09
Billie Jean\Inbox      6/4/2013 12:58
Kip Dog\Inbox          9/9/2013 22:32
Bam Forrest\Inbox      9/16/2013 17:14
Timmy Smith\Inbox      10/15/2013 21:31
Rocky Road\Inbox       12/11/2013 17:17
Timothy Rails\Inbox    12/17/2013 16:13
MJ Farradson\Inbox     12/17/2013 21:51
Joe Bob\Inbox          3/21/2014 18:04
Erica Meadows\Inbox    4/9/2014 0:22

Identity                  OldestItemReceivedDate
--------                  ----------------------
James Smith\Sent Items    5/18/2013 17:17
Joe Bob\Sent Items        6/11/2013 20:35
Doug Dogerson\Sent Items  8/3/2013 23:39
Billie Jean\Sent Items    10/9/2013 14:33
MJ Farradson\Sent Items   12/3/2013 18:42
Erica Meadows\Sent Items  4/9/2014 0:50

Using this data and knowing the migration was on 4/9/2015 we are able to find users who had a retention policy older than a year (everyone who's box contains items older than 4/9/2014, a year from the date of the migration).   

Also, I highlighted Doug Dogerson as it appears this user moves items from his Inbox (our Inbox query did not find him) but he does not clear out his Sent Items and thus we were find him in the Sent Items query.  

This isn't a foolproof method (it would not catch users who cleared out both their Inbox and Sent Items) but it does give you a general idea of who fell into which Retention Policy prior to the migration. 

Or you can always Contact Us for assistance with your migration. Our Managed IT Services can fully support, monitor and manage your Microsoft 365 environment. Lewan is a Silver Certified Microsoft Solutions Partner.

Topics: Microsoft, Microsoft Exchange, Microsoft Office, Microsoft Outlook, Email Security, PowerShell

John Certeza
Written by John Certeza

John is a Systems Engineer on the Managed Services team at Lewan Technology.

  • View & Submit Comments

[fa icon="envelope"] Subscribe to Email Updates

[fa icon="comments-o"] Follow us

Get even more great content, photos, event info and industry news.

[fa icon="calendar"] Recent Posts