exclude MSTransport ? Whats the difference to disable defender?

if I understand it correctly. Since all Exchange services are excluded, we can deactivate the virus scanner, since only Exchange is running on the server.

Thanks Andy,

so many exclusions. Has someone an Powershell Script that do this

take a look of one of the best report scripts

https://www.frankysweb.de/neue-exchange-reporter-version-exchange-reporter-3-7/

use binary it is more then 10x faster then .NET

https://github.com/logpresso/CVE-2021-44228-Scanner

it's an encoding problem

please try -Encoding

 Get-Content C:\temp\excelTEst.csv | select -First 1 | Set-Content c:\temp\testy.csv -Encoding Default

why do you differ 30,60,90 days? If you use Archiv all email from inbox stored in inbox. If you search a e-mail you can't remember is it in 30, 60 or 90-day folder.

if it is an adhoc job you can try it with vba https://docs.microsoft.com/en-us/office/vba/api/outlook.folders.add

I don't know you full file but you can try import-csv with -delimiter ":"

TB-1159 found another cool solution
you can use ISE and debugg (F9) Mode - it's nice to see the output

 $spalte = 0
    
 $File = Get-Content C:\temp\node.txt
    
 $excel = New-Object -ComObject Excel.Application
 $workbook = $excel.workbooks.add()
 $excel.visible = $true
    
 ForEach($line in $File){
 write-host $line -ForegroundColor Yellow
    
   If($line -match "node"){ # new Column
     $zeile=1
     $spalte++
     $excel.cells.item($zeile,$spalte) = $line
    
   }
   else{ # same column
     $zeile++
     $excel.cells.item($zeile,$spalte) = $line
   }
 }

you can try your export with other Character

 export-csv -Delimiter ";"

try also invoke-item

Andy,
Output is from test-proxyLogon Script, but it is not 443 and i can't find any .zip .7z files or new aspx files

you can also try this

 (Get-Content C:\temp\test.txt) -replace '\s{1,}',';' | Out-File c:\temp\test2.csv

Rich,
a little question. I am new with Powershell. Can you tell me why

  $all = Select-String -Path $fn -Pattern "^NAME\s:\s.+\.ApplicationException$" -Context 3,4 | 
              Select-Object -Last 1

didn't work with select-string? Because it not a object?

we have same problems if we use a proxy. Without Proxy direkt to firewall it works fine