Hello ALL,
Sometimes in the Exchange organization you have to find and delete some emails that someone sent by mistake, delete inappropriate or potentially harmful e-mail messages sent to multiple mailboxes across their organization and you have to do this ASAP to avoid this email be read for people supposed to NOT read.
Below a short example about how to find and delete email was sent by mistake.
Scenario: Delete for all users under OU (let’s call "São Paulo") the email with the subject "MARCELOCHANGTESTE" .
PS: Can't use Multi-Mailbox Search in the Exchange Control Panel for this purpose, but, in Windows PowerShell, can do it, using theSearch-Mailbox cmdlet with the DeleteContent switch parameter.
Important: When use the Search-Mailbox cmdlet with the DeleteContent parameter, messages are permanently deleted from the user's mailbox and can't be recovered.
Actions
==================
First you need have the correct permission to execute the cmdlet 'search-mailbox'. To do this you have to add the permissions below:
Assign the required RBAC roles
Mailbox Search This role allows search for messages across multiple mailboxes in your organization.Administrators aren't assigned this role by default. To search multiple mailboxes, add yourself as a member of the Discovery Management role group.
Mailbox Import Export This role allows delete messages from a user's mailbox. This role isn't assigned to administrators by default. To delete messages from users' mailboxes, add the Mailbox Import Export role to the Organization Management role group.
In that case added the Roles under the Organization Management role group.
Without the Roles above it's not possible run the cmdlet.
Commands and Results:
The following command searches all mailbox under the OU "SaoPaulo" for messages with a specific value in the Subject line “in that case MARCELOCHANGTESTE”and then sends a message with the results to the target mailbox.
Get-Mailbox -OrganizationalUnit "mpc.lab/Organizations/Users and Groups/SaoPaulo" |Search-Mailbox -SearchQuery 'Subject:"MARCELOCHANGTESTE"' -TargetMailbox "MCHANG" -TargetFolder "SearchAndDeleteLog" -LogOnly -LogLevel Full
Report:
RunspaceId : 0d671b70-775b-4a66-84e9-ae3d8bddc407
Identity : mpc.lab/Organizations/Users and Groups/SaoPaulo/JOAODASILVA
TargetMailbox : mpc.lab/Organizations/Users and Groups/SaoPaulo/MCHANG
TargetPSTFile :
Success : True
TargetFolder : \SearchAndDeleteLog\UserName UHT-6/16/2012 6:21:18 PM
ResultItemsCount : 14
ResultItemsSize : 119.8 KB (122,687 bytes)
The following command searches for messages with the subject line and then permanently deletes them.
Get-Mailbox -OrganizationalUnit "mpc.lab/Organizations/Users and Groups/SaoPaulo" |Search-Mailbox -SearchQuery 'Subject:"MARCELOCHANGTESTE"' -DeleteContent
RunspaceId : 0d671b70-775b-4a66-84e9-ae3d8bddc407
Identity : mpc.lab/Organizations/Users and Groups/SaoPaulo/JOAODASILVA
TargetMailbox :
TargetPSTFile :
Success : True
TargetFolder :
ResultItemsCount : 8
ResultItemsSize : 113.9 KB (116,677 bytes)
