How to Delete Emails from Mailboxes in Exchange 2010 Using Search-Mailbox

Exchange 2010, Exchange 2013, Scripting, Security

Quick post today.  If you have an criteria of emails that you want to delete from all mailbox’s you can use Search-Mailbox to delete the message from users mailbox.  For example, you get hit with a virus email that has the subject “I am a virus” from the user virussender@virus.com.

The below search goes through all mailbox’s and deletes any email with the subject “I am a virus”:

 

get-mailbox | Search-Mailbox -SearchQuery ‘subject:”I am a virus.” ‘ -TargetMailbox “adminmailbox” -TargetFolder “DeleteVirus” -LogLevel Full –DeleteContent

 

That above command will delete the emails from the users mailbox’s and copy them to the adminmailbox in the folder DeleteVirus

The next search does it based on the sender of the email:

get-mailbox | Search-Mailbox -SearchQuery ‘from:virussender@virus.com ‘ -TargetMailbox “adminmailbox” -TargetFolder “DeleteVirus” -LogLevel Full –DeleteContent

 

The above search does the same thing as the first, except this query does it based on the from address of the sender versus the subject.

If you log into the admin mailbox, you can see the results of the search and log files for it:

 

image

You can also run the same commands without the –DeleteContent switch to copy the messages to the admin mailbox for review before running the commands to delete.

Remember, do this at your own risk and test test test before you run it!

Comments;

  1. Mike

    Hi, any ideas why -deleteContent is not available (Exchange 2010 SP1) thx

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *