Mass delete inbox rule from organization matching name 'main'
We were recently targeted for phishing emails and found quite a few employees got compromised.
As part of the attack, the BOT created a new Inbox Rule called "Main" and "Main1" into users profiles. This rule is to forward any/all email to an external source, delete any auto-replies sent back after the phishing email triggered back out to other contacts etc.
The one common factor is the rules all seemed to be called "Main" or "Mail1".
Is there a way to delete all mailbox rules in the organization that are named "Main"?
C:\> Get-Mailbox -ResultSize Unlimited | Remove-InboxRule -Identity "main"
The input object cannot be bound to any parameters for the command either because the command does not take pipeline input or the input and its properties do not match any of the parameters that take pipeline input.
+ CategoryInfo : InvalidArgument: (cdfgfdg, mansur:PSObject) [Remove-InboxRule], ParameterBindingException
+ FullyQualifiedErrorId : InputObjectNotBound,Remove
+ PSComputerName : ps.outlook.com
As part of the attack, the BOT created a new Inbox Rule called "Main" and "Main1" into users profiles. This rule is to forward any/all email to an external source, delete any auto-replies sent back after the phishing email triggered back out to other contacts etc.
The one common factor is the rules all seemed to be called "Main" or "Mail1".
Is there a way to delete all mailbox rules in the organization that are named "Main"?
C:\> Get-Mailbox -ResultSize Unlimited | Remove-InboxRule -Identity "main"
The input object cannot be bound to any parameters for the command either because the command does not take pipeline input or the input and its properties do not match any of the parameters that take pipeline input.
+ CategoryInfo : InvalidArgument: (cdfgfdg, mansur:PSObject) [Remove-InboxRule], ParameterBindingException
+ FullyQualifiedErrorId : InputObjectNotBound,Remove
+ PSComputerName : ps.outlook.com
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
just to clarify, my given code is working with you right?
ASKER
cmdlet Remove-InboxRule at command pipeline position 1
Supply values for the following parameters:
Cannot display the prompt for "Identity" because type "Microsoft.Exchange.Config
+ CategoryInfo : ResourceUnavailable: (:) [], PromptingException
+ FullyQualifiedErrorId : System.Management.Automati
+ PSComputerName : ps.outlook.com