将Powershell与大型O365租户一起使用

Question

I have been tasked with creating a powershell script that will crawl through one of our clients Office365 enviroments daily and disable POP/IMAP Access to anyone not in a specific security group.

I have written the code and it works, up until it gets about 75% of the way through our ~5000+ mailboxes, then it starts to fail with "Starting a command on the remote server failed with the following error message : The I/O operation has been aborted because of either a thread exit or an application request. For more"

I imagine it is somehow timing out due to there being so many mailboxes, but not sure how to more efficiently write my script? Any ideas?

Connect-EXOPSSession

Connect-MSOLService

$PopGroup = Get-MSOLGroup -All | Where-Object {$_.DisplayName -eq "POP Exception"}

$ImapGroup = Get-MSOLGroup -All | Where-Object {$_.DisplayName -eq "IMAP Exception"}

$EnablePOP = Get-MSOLGroupMember -GroupObjectId $PopGroup.ObjectId -All | Select-Object -ExpandProperty DisplayName

$EnableImap = Get-MSOLGroupMember -GroupObjectId $ImapGroup.ObjectId -All | Select-Object -ExpandProperty DisplayName

$Mailboxes = $Mailboxes = Get-Mailbox -ResultSize Unlimited

ForEach ($Mailbox in $Mailboxes) { 
  If ($EnablePop -Contains $Mailbox) { 
      $Mailbox | Set-CASMailbox -PopEnabled $True } 
  Else { 
      $Mailbox | Set-CASMailbox -PopEnabled $False } 
  If ($EnableImap -Contains $Mailbox) { 
      $Mailbox | Set-CASMailbox -ImapEnabled $True } 
  Else { 
      $Mailbox | Set-CASMailbox -ImapEnabled $False }}

Answer 1

That error message appears to be a performance limitation or I/O timeout (see this blog entry from MS for example of this issue). I have a couple of ideas to try:

1. Your Get-MSOLGroup -ALL commands are pulling the entire list of AD groups and then filtering, it would be better to specify the UPN or SearchString to filter your request. See this link for examples and common performance tips for PS. Try $PopGroup = Get-MSOLGroup -SearchString "POP Exception"

2. Try using Get-CASMailbox instead of getting all mailboxes with all of their data:

    Get-CASMailbox -ResultSize Unlimited | foreach-object { $upn = "$_@YOURDOMAIN.COM" if($_.POPEnabled -eq $true -and $(!($EnablePop.EmailAddress -Contains $upn))){ Set-CASMailbox -Identity $upn -PopEnabled $false } elseif ($_.POPEnabled -eq $false -and $EnablePop -Contains $upn){ Set-CASMailbox -Identity $upn -PopEnabled $true } if($_.ImapEnabled -eq $true -and $(!($EnableImap -Contains $upn))){ Set-CASMailbox -Identity $upn -ImapEnabled $false } elseif($_.ImapEnabled -eq $false -and $EnablePop -Contains $upn){ Set-CASMailbox -Identity $upn -ImapEnabled $true } }