• Enfield, Waltham Abbey
  • 0844 567 4250

Search

Delete E-mail Messages from all Mailboxes in Exchange 2010

Dec 19

Written by:
Wed, 19 Dec 2012 15:59:00 GMT  RssIcon

Have you ever been in the situation where you had to quickly delete an email from all mailboxes in Exchange? This quick guide will help you achieve that goal.
Note: This methodis  for Exchange 2010 SP1, other versions have not been documented here.

Prerequisites

Firstly, be sure the account you use to run PowerShell Command Line has appropriate permissions; you need to grant access to the New-MailboxImportRequest command. No one has permissions to this cmdlet by default,. Without the correct permissions you will get an error “The term ‘New-MailboxImportRequest’ is not recognized as the name of a cmdlet”.

To add the permission follow these simple steps:

  1. Create a Universal Security group and give it a suitable name in Active Directory Users and Computers.
  2. Run the command below:
    1 New-ManagementRoleAssignment -Name "Import Export Mailbox Admins" -SecurityGroup "*SecurityGroupName*" -Role "Mailbox Import Export"

Notes:

  • Change *SecurityGroupName* in the above cmdlet to the name of your newly created Universal Security Group
  • The New-MailboxImportRequest cmdlet will only works with UNC shares
  • The “Exchange Trusted Subsystem” group should be granted read/write permission to the shared location

Use PowerShell to search for the message and log the results

We highly recommend running a test before going through with the process as the command can have unexpected results if executed incorrectly. Below is an example and should be used to test what you are going to delete. It runs a scan, then reports on the output, (along with the locations of the items).

1 Get-Mailbox -Server  "*Server*" | Search-Mailbox -SearchQuery 'Subject:"*Subject*" and Body:"*Body*"' -targetmailbox "*SearchMailbox*" -targetfolder "*SearchFolder*" -logonly -loglevel full

The above code searches a server specified (and all the databases on it) for a query that meets a particular subject and body. It  sends the logs to a mailbox and folder.

Preview of the output:

Notes:

Search and delete e-mail messages Exchange 2010 SP1

All that is left to do now is run the command that will commit the process. There are many variations in what you can do so i will include several examples to suit the most common scenarios:

  • Delete all email messages that meet the search query
    1 Get-Mailbox -Server  "*Server*" | Search-Mailbox -SearchQuery 'Subject:"*Subject*" and Body:"*Body*"' -deletecontent
  • Copy emails to a single mailbox, then delete the source emails
    1 Get-Mailbox -Server  "*Server*" | Search-Mailbox -SearchQuery 'Subject:"*Subject*" and Body:"*Body*"' -targetmailbox "*SearchMailbox*" -targetfolder "*SearchFolder*" -loglevel full -deletecontent

Sources:

Copyright Love 4 IT © 2012

1 comments so far...


Gravatar

I regularly use this technique to remove the occasional phishing attempt that slips past the anti-spam filters and posted an article about it just yesterday. :-) You have to be very careful with the subject lines, etc. If you search for a subject line of "Company" it will find everything with a subject line that begins with "Company". (I'm not sure if it includes everything with "Company" anywhere in the subject or only at the beginning.) The wildcard is assumed. I never use it without the TargetMailbox parameter because it's so easy to delete the wrong thing.

By jay c on   Wed, 08 May 2013 18:33:23 GMT

Your name:
Gravatar Preview
Your email:
(Optional) Email used only to show Gravatar.
Comment:
Security Code
CAPTCHA image
Enter the code shown above in the box below
Add Comment   Cancel 

Contact Us

Have an I.T Problem? Get in touch for an informal chat and find out how we can help

Click here

Blog Calendar

Archive
<November 2017>
MonTueWedThuFriSatSun
303112345
6789101112
13141516171819
20212223242526
27282930123
45678910
Monthly
Go
By continuing to use this site you agree to the use of cookies. To view our policy on cookies click here