Hybrid Exchange 2016 - looking to pull data from all mail forwarding fields.

I am learning/working in Exchange with a handful of accounts on-prem, some hybrid, and many only in Office365.
A phishing attempt caught a few hybrid-mailbox users and turned on their forwarding. I want to see all hybrid mailboxes with forwarding on and the address that mail is being forwarded to.
The Mail Forwarding setting in O365 doesn't show up in my script that selects ForwardingSmtpAddress, DeliverToMailboxAndForward, ForwardingAddress, and AutoForwardEnabled. What other field can I select to list data that has been configured in O365 here?:
Mail forwarding screenshot from O365
Also, my issue might be that I am running the Get-RemoteMailbox cmdlet without starting a PSSession to outlook.office365.com like many of our other scripts. If I start a new session, the get-mailbox cmdlet will only get mailboxes that are completely cloud-based. Get-mailbox from my mail server will I only get the handful of on-prem-only accounts. From my on-prem server, get-RemoteMailbox does report the hybrid boxes.

Thanks for any info pointing me in the right direction!

Daniel MillerAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Vasil Michev (MVP)Commented:
You need to get this information via the corresponding ExO PowerShell cmdlets, forwarding settings are not synced back to on-prem and will not be reflected in the Get-RemoteMailbox output.
FOXActive Directory/Exchange EngineerCommented:
Daniel, if you don't have an issue with running the command once in your on prem environment then connecting to your o365 and running it , the command is the below.

Get-mailbox -ResultSize Unlimited | select DisplayName,ForwardingAddress | where {$_.ForwardingAddress -ne $Null}

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Daniel MillerAuthor Commented:
To clarify, we have 35,000-40,00 addresses like @child.daniel.net and 4,000-5,000 addresses like @daniel.net. The child.domain.net addresses are only in the cloud, and the domain.net accounts are hybrid. When I went to pull the data (by connecting to o365 and running what FOX has) I thought I wasn't getting data from my @daniel.net domain, but I might have been mistaken.

By adding a filter I was able to locate the breached accounts that had forwarding set up.

Get-Mailbox -ResultSize unlimited -filter{WindowsEmailAddress -like '*@daniel.net'} | where {$_.ForwardingSmtpAddress -ne $Null } | select WindowsEmailAddress,ForwardingSmtpAddress #| Export-Csv C:\Users\me\Desktop\needsReset.csv

Thanks you two for the help! It really helped!
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.