I wrote a machine-based rule to check if the environment contains anyone who was actively using PST’s per management request. Voila:
$primaryUser = "" # use some method to determine the primary user of the machine $officeVersion = "16.0" $sid = (New-Object System.Security.Principal.NTAccount($primaryUser)).Translate([System.Security.Principal.SecurityIdentifier]).value $valuesarray = New-Object System.Collections.ArrayList New-PSDrive -PSProvider Registry -Name HKU -Root HKEY_USERS -ErrorAction SilentlyContinue | Out-Null $strOutlookSubkey = "HKU:\$sid\Software\Microsoft\Office\$officeVersion\Outlook\Profiles\Outlook" $outlookSubkey = (Get-ChildItem "$strOutlookSubkey" -ErrorAction SilentlyContinue).PSChildName foreach ($key in $outlookSubkey){ $properties = $null $properties = (Get-Item "$strOutlookSubkey\$key").Property foreach ($property in $properties){ if ((Get-ItemPropertyValue -Path "$strOutlookSubkey\$key" -Name $property).GetType().Name -eq 'Byte[]'){ $valuesarray.Add([System.Text.Encoding]::Unicode.GetString((Get-ItemPropertyValue -Path "$strOutlookSubkey\$key" -Name $property))) | Out-Null } } } $filteredValuesArray = ($valuesarray | ? {$_ -like "*.pst*"}) | % {$_.substring($_.IndexOf(':')-1)} | unique | ? {$_ -notlike "*Internet Calendar Subscriptions*" -and $_ -notlike "*SharePoint Lists*"} if(!($filteredValuesArray)){"NONE"} else {$filteredValuesArray}