Use Mailbox Search to Delete Messages

Hello ALL,

 

Sometimes in the Exchange organization you have to find and delete some emails that someone sent by mistake, delete inappropriate or potentially harmful e-mail messages sent to multiple mailboxes across their organization and you have to do this ASAP to avoid this email be read for people supposed to NOT read.

Below a short example about how to find and delete email was sent by mistake.

 

Scenario: Delete for all users under OU (let’s call "São Paulo") the email with the subject "MARCELOCHANGTESTE" .

 

PS:  Can't use Multi-Mailbox Search in the Exchange Control Panel for this purpose, but, in Windows PowerShell, can do it, using theSearch-Mailbox cmdlet with the DeleteContent switch parameter.

 

Important: When use the Search-Mailbox cmdlet with the DeleteContent parameter, messages are permanently deleted from the user's mailbox and can't be recovered.

 

Actions

==================

First you need have the correct permission to execute the cmdlet 'search-mailbox'. To do this you have to add the permissions below:

Assign the required RBAC roles

Mailbox Search   This role allows search for messages across multiple mailboxes in your organization.Administrators aren't assigned this role by default. To search multiple mailboxes, add yourself as a member of the Discovery Management role group.

Mailbox Import Export   This role allows delete messages from a user's mailbox. This role isn't assigned to administrators by default. To delete messages from users' mailboxes, add the Mailbox Import Export role to the Organization Management role group.

 

 

In that case added the Roles under the Organization Management role group.

Without the Roles above it's not possible run the cmdlet.

 

Commands and Results:

The following command searches all mailbox under the OU "SaoPaulo" for messages with a specific value in the Subject line “in that case MARCELOCHANGTESTE”and then sends a message with the results to the target mailbox.

Get-Mailbox -OrganizationalUnit "mpc.lab/Organizations/Users and Groups/SaoPaulo" |Search-Mailbox -SearchQuery 'Subject:"MARCELOCHANGTESTE"' -TargetMailbox "MCHANG" -TargetFolder "SearchAndDeleteLog" -LogOnly -LogLevel Full

Report:

RunspaceId       : 0d671b70-775b-4a66-84e9-ae3d8bddc407

Identity         : mpc.lab/Organizations/Users and Groups/SaoPaulo/JOAODASILVA

TargetMailbox    : mpc.lab/Organizations/Users and Groups/SaoPaulo/MCHANG

TargetPSTFile    :

Success          : True

TargetFolder     : \SearchAndDeleteLog\UserName UHT-6/16/2012 6:21:18 PM

ResultItemsCount : 14

ResultItemsSize  : 119.8 KB (122,687 bytes)

The following command searches for messages with the subject line  and then permanently deletes them.

Get-Mailbox -OrganizationalUnit "mpc.lab/Organizations/Users and Groups/SaoPaulo" |Search-Mailbox -SearchQuery 'Subject:"MARCELOCHANGTESTE"' -DeleteContent

RunspaceId       : 0d671b70-775b-4a66-84e9-ae3d8bddc407

Identity         : mpc.lab/Organizations/Users and Groups/SaoPaulo/JOAODASILVA

TargetMailbox    :

TargetPSTFile    :

Success          : True

TargetFolder     :

ResultItemsCount : 8

ResultItemsSize  : 113.9 KB (116,677 bytes)

 

Additional Information

========================

 

Use Mailbox Search to Delete Messages

Pasted from <http://technet.microsoft.com/en-us/library/ff459253.aspx>

Search For and Delete Messages from Users' Mailboxes

Pasted from <http://help.outlook.com/en-ca/140/gg315525.aspx>