Automatische Email Forwarding Blocked

<# .SYNOPSIS Automatic Mail Forwarding Blocked .DESCRIPTION Blocks automatic email forwarding to external domains to prevent data exfiltration. Users should not be able to auto-forward company emails externally. .NOTES Filename: mail-forwarding-blocked.ps1 Author: Nederlandse Baseline voor Veilige Cloud .EXAMPLE .\mail-forwarding-blocked.ps1 -Monitoring Check if auto-forward blocking is configured .EXAMPLE .\mail-forwarding-blocked.ps1 -Remediation Create transport rule to block auto-forwarding #> #Requires -Version 5.1 #Requires -Modules ExchangeOnlineManagement [CmdletBinding()] param( [Parameter(Mandatory = $false)] [switch]$Monitoring, [Parameter(Mandatory = $false)] [switch]$Remediation, [Parameter(Mandatory = $false)] [switch]$Revert, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Mail Forwarding Blocked" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { <# .SYNOPSIS Checks if auto-forward blocking rules exist #> try { Write-Host "Connecting to Exchange Online..." -ForegroundColor Gray Connect-ExchangeOnline -ShowBanner:$false -ErrorAction Stop Write-Host "Checking for auto-forward blocking rules..." -ForegroundColor Gray $rules = Get-TransportRule | Where-Object { $_.SentToScope -eq 'NotInOrganization' -and $_.MessageTypeMatches -eq 'AutoForward' } $result = @{ isCompliant = ($rules.Count -gt 0) blockingRules = $rules.Count ruleNames = @() } if ($rules.Count -gt 0) { Write-Host " [OK] Auto-Forward Blocking Rules: $($rules.Count)" -ForegroundColor Green foreach ($rule in $rules) { Write-Host " • $($rule.Name)" -ForegroundColor Gray Write-Host " State: $($rule.State)" -ForegroundColor Cyan Write-Host " Action: $($rule.RejectMessageReasonText)" -ForegroundColor Cyan $result.ruleNames += $rule.Name } } else { Write-Host " [FAIL] No auto-forward blocking rules found!" -ForegroundColor Red Write-Host " Data exfiltration risk - users can forward emails externally" -ForegroundColor Red } if ($result.isCompliant) { Write-Host "`n[OK] COMPLIANT - Auto-forwarding is blocked" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - Auto-forwarding not blocked!" -ForegroundColor Red exit 1 } } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Remediation { <# .SYNOPSIS Creates transport rule to block auto-forwarding #> try { Write-Host "Connecting to Exchange Online..." -ForegroundColor Gray Connect-ExchangeOnline -ShowBanner:$false -ErrorAction Stop Write-Host "Checking for existing rules..." -ForegroundColor Gray $existing = Get-TransportRule | Where-Object { $_.Name -eq 'Block Auto-Forward to External - NL Baseline' } if ($existing) { Write-Host " [OK] Auto-forward blocking rule already exists" -ForegroundColor Green exit 0 } Write-Host "Creating auto-forward blocking rule..." -ForegroundColor Gray $ruleParams = @{ Name = 'Block Auto-Forward to External - NL Baseline' SentToScope = 'NotInOrganization' MessageTypeMatches = 'AutoForward' RejectMessageReasonText = 'Automatic forwarding to external addresses is blocked for security reasons. Contact IT if you need an exception.' Comments = 'Nederlandse Baseline voor Veilige Cloud - Prevents data exfiltration via auto-forwarding' } New-TransportRule @ruleParams -ErrorAction Stop Write-Host "`n[OK] Auto-forward blocking rule created" -ForegroundColor Green Write-Host "`nWhat this blocks:" -ForegroundColor Cyan Write-Host " • Inbox rules forwarding to external addresses" -ForegroundColor Gray Write-Host " • Client-side forwarding rules" -ForegroundColor Gray Write-Host " • Automatic forwards set by users" -ForegroundColor Gray Write-Host "`nWhat this allows:" -ForegroundColor Cyan Write-Host " • Manual forwarding (user clicks Forward)" -ForegroundColor Gray Write-Host " • Internal forwarding (within organization)" -ForegroundColor Gray exit 0 } catch { Write-Host "`n[FAIL] ERROR: $_" -ForegroundColor Red exit 2 } } function Invoke-Revert { <# .SYNOPSIS Removes auto-forward blocking rule #> try { Write-Host "⚠️ WARNING: Removing this rule allows data exfiltration!" -ForegroundColor Yellow Write-Host "Connecting to Exchange Online..." -ForegroundColor Gray Connect-ExchangeOnline -ShowBanner:$false -ErrorAction Stop $rule = Get-TransportRule | Where-Object { $_.Name -eq 'Block Auto-Forward to External - NL Baseline' } if ($rule) { Remove-TransportRule -Identity $rule.Identity -Confirm:$false -ErrorAction Stop Write-Host " ⚠️ Auto-forward blocking rule removed" -ForegroundColor Yellow } else { Write-Host " Rule not found" -ForegroundColor Gray } exit 0 } catch { Write-Host "ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Revert) { Invoke-Revert } elseif ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { Invoke-Remediation } else { Write-Host "Usage:" -ForegroundColor Yellow Write-Host " -Monitoring Check for blocking rules" -ForegroundColor Gray Write-Host " -Remediation Create blocking rule" -ForegroundColor Gray Write-Host " -Revert Remove blocking rule (NOT RECOMMENDED!)" -ForegroundColor Red } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan }