Recover deleted items from a group mailbox with EWS Managed API 2.2

In case you're interested in recovering the deleted items from a group mailbox...


-Create a new RBAC group or use an existing one from Exchange Admin Center – Permissions – Admin Roles. Add the ‘ApplicationImpersonation’ role to the group and add as member the service account that will impersonate the mailbox that is a member/owner of the declared group mailbox (it can be your Global Admin account).

-The script requires EWS Managed API 2.2, which can be downloaded here:


 DISCLAIMER:  This application is a sample application. The sample is provided "as is" without warranty of any kind. Microsoft further disclaims all implied warranties including without limitation any implied warranties of merchantability or of fitness for a particular purpose. The entire risk arising out of the use or performance of the samples remains with you. in no event shall Microsoft or its suppliers be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss arising out of the use of or inability to use the samples, even if Microsoft has been advised of the possibility of such damages). Because some states do not allow the exclusion or limitation of liability for consequential or incidental damages, the above limitation may not apply to you. 

 $a = Read-Host -Prompt "Mailbox name" 
 $b = Read-Host -Prompt "Group mailbox" 

Import-Module -Name "C:\Program Files\Microsoft\Exchange\Web Services\2.2\Microsoft.Exchange.WebServices.dll" 

 $service = New-Object Microsoft.Exchange.WebServices.Data.ExchangeService -ArgumentList Exchange2013_SP1

#Provide the credentials 
$credential = Get-Credential -Message "Type the credentials of the mailbox with impersonation rights on $($a)"

$service.Credentials = new-object Microsoft.Exchange.WebServices.Data.WebCredentials -ArgumentList $credential.UserName, $credential.GetNetworkCredential().Password

 #Exchange Online URL
 $service.Url= new-object Uri("") 

 #User to impersonate
 $service.ImpersonatedUserId = new-object Microsoft.Exchange.WebServices.Data.ImpersonatedUserId([Microsoft.Exchange.WebServices.Data.ConnectingIdType]::SmtpAddress,$a) 

 $DeletionsFolderid = new-object Microsoft.Exchange.WebServices.Data.FolderId([Microsoft.Exchange.WebServices.Data.WellKnownFolderName]::RecoverableItemsDeletions,$b) 

 $InboxFolderid = new-object Microsoft.Exchange.WebServices.Data.FolderId([Microsoft.Exchange.WebServices.Data.WellKnownFolderName]::Inbox,$b) 

 $CalendarFolderid = new-object Microsoft.Exchange.WebServices.Data.FolderId([Microsoft.Exchange.WebServices.Data.WellKnownFolderName]::Calendar,$b) 

 $ItemView = new-object Microsoft.Exchange.WebServices.Data.ItemView(1000) 

 $FindItemResults = $service.FindItems($DeletionsFolderid,$ItemView) 

write-host "$($FindItemResults.TotalCount) item(s) has/have been found in the Recoverable items folder" -ForegroundColor White

foreach ($Item in $FindItemResults.Items) 

 #Restore the emails

if ($Item.ItemClass -match "IPM.Note") 

 $Message = [Microsoft.Exchange.WebServices.Data.EmailMessage]::Bind($service,$Item.Id) 




 #Restore the calendar events

if ($Item.ItemClass -match "IPM.Appointment") 

 $Message = [Microsoft.Exchange.WebServices.Data.Appointment]::Bind($service,$Item.Id) 




if(!$i -and !$j) { Write-Host "The Item with the Subject:'$($Item.Subject)' has the ItemClass '$($Item.ItemClass)' and will not be recovered" -ForegroundColor Yellow } 


 $ItemView.offset += $FindItemResults.Items.Count

 }while($FindItemResults.MoreAvailable -eq $true) 

Write-Host "$($i) Email(s) was/were recovered and moved to the Inbox folder" -ForegroundColor White
Write-Host "$($j) Appointment(s) was/were recovered and moved to the Calendar folder" -ForegroundColor White