Find Exchange Online Mailbox Hidden Inbox Rules using PowerShell

How to find Exchange Online mailbox hidden Outlook inbox rules using PowerShell and show the contents of rules to check for suspicious actions.

Get Outlook hidden inbox rules using PowerShell Get-InboxRule

# get inbox rules 
Get-InboxRule -Mailbox user@domain.com 

In this example, we can only see one rule

But when we run the PowerShell again with the -IncludeHidden option, we can see more rules

# get hidden inbox rules
Get-InboxRule -Mailbox user@domain.com -IncludeHidden 

View details of hidden inbox rules - all properties

In this example, we can show the properties of the inbox rules to get more information about the content of the rules.

Get-InboxRule -Mailbox user@domain.com -includehidden | Select-object * 
 

Show only certain inbox rule properties

In this example, we are selecting only the rule properties that show us what actions the rule contains. This way, we can check for any rules that could be forwarding to a suspicious external email address

# get inbox rule details, format list
Get-InboxRule -Mailbox user@domain.com -includehidden | Select-object Name, Description, Enabled, RedirectTo, MoveToFolder, ForwardTo | fl

# get inbox rule details, export to file
Get-InboxRule -Mailbox user@domain.com -includehidden | Select-object Name, Description, Enabled, RedirectTo, MoveToFolder, ForwardTo | Out-File C:\Temp\inboxrules.txt 

Remove hidden Outlook inbox rules using PowerShell Remove-InboxRule

Get-InboxRule -Mailbox user@domain.com -includehidden  

Copy the rule identity. You'll need this to delete the inbox rule 

Remove Outlook inbox rules using PowerShell Remove-InboxRule

Remove one inbox rule using -Identity

# Remove one inbox rule using -Identity
Remove-InboxRule -Mailbox user@domain.com -Identity 1125502695398965249 -Confirm:$false 

Remove all inbox rules including hidden rules for a mailbox

# Remove all inbox rules including hidden rules
Get-InboxRule -Mailbox "user@domain.com" -includehidden | Remove-InboxRule 

Delete Outlook rules using /cleanrules

This command starts Outlook and deletes all client and server inbox rules

Outlook.exe /cleanrules

References:

Exchange PowerShell - Get-InboxRule
https://docs.microsoft.com/en-us/powershell/module/exchange/get-inboxrule

Exchange PowerShell - Remove-InboxRule
https://docs.microsoft.com/en-us/powershell/module/exchange/remove-inboxrule

Command-line switches for Microsoft Office products
https://support.microsoft.com/en-us/office/command-line-switches-for-microsoft-office-products-079164cd-4ef5-4178-b235-441737deb3a6

by Author