The mail queue database in Exchange temporarily holds the location for messages. These messages are…
Search and delete messages from Exchange user mailboxes
Today’s article will show how to search and delete messages from Exchange user mailboxes. A user sent an email to the whole organization that contains more than a thousand users, with all of them having a mailbox. The task is to delete the email from every mailbox in the organization. How to search and delete messages from Exchange user mailboxes?
Table of contents
Information
The only thing that we have is the subject of that email. Do you like to know how to get the subject of an email and delete that particular email from a mailbox? Read the article Search and delete email from Exchange user mailbox.
Export all users email addresses
Export all users with a mailbox to a CSV file. The CSV file will contain a list of all the email addresses. First, create a folder on your (C:) drive and name it temp. The folder will look like C:\temp\.
Run Exchange Management Shell as administrator. Run the cmdlet to get a list of all the email addresses of the users.
Get-Mailbox -ResultSize Unlimited | Select-Object DisplayName, SamAccountName, PrimarySmtpAddress | Sort-Object PrimarySmtpAddress | Export-Csv "c:\temp\user_mailboxes.csv" -NoTypeInformation -Encoding UTF8
Go to the CSV file and make sure that the attribute PrimarySmtpAddress appears on the first line.
You can edit the CSV file with Microsoft Excel and remove the users you don’t want to search on. In our example, we want all of the user mailboxes and leave it as is.
Import CSV file in PowerShell
Before running the cmdlet in the next step, import the CSV file in PowerShell. It’s an excellent way to check if it’s readable and if you’re all set.
Read more: Import CSV delimiter PowerShell »
Import-Csv "C:\temp\user_mailboxes.csv"
The below output appears.
DisplayName SamAccountName PrimarySmtpAddress
----------- -------------- ------------------
Administrator Administrator Administrator@exoip.com
Tajran, Ali Ali.Tajran Ali.Tajran@exoip.com
Amanda Morgan Amanda.Morgan Amanda.Morgan@exoip.com
Nash, Amelia Amelia.Nash Amelia.Nash@exoip.com
Campbell, Boris Boris.Campbell Boris.Campbell@exoip.com
Christopher Payne Christopher.Payne Christopher.Payne@exoip.com
Piper, Dylan Dylan.Piper Dylan.Piper@exoip.com
Rees, Grace Grace.Rees Grace.Rees@exoip.com
Springer, Irene Irene.Springer Irene.Springer@exoip.com
Teneres, Jasmina Jasmina.Teneres Jasmina.Teneres@exoip.com
Fisher, Jonathan Jonathan.Fisher Jonathan.Fisher@exoip.com
Davidson, Kylie Kylie.Davidson Kylie.Davidson@exoip.com
Clark, Leonard Leonard.Clark Leonard.Clark@exoip.com
Fisher, Madeleine Madeleine.Fisher Madeleine.Fisher@exoip.com
Walsh, Mary Mary.Walsch Mary.Walsh@exoip.com
Fraser, Max Max.Fraser Max.Fraser@exoip.com
Scott, Melanie Melanie.Scott Melanie.Scott@exoip.com
Discovery Search Mailbox SM_5aab23c8c7d6435eb MsExchDiscoveryMailboxD919BA05-46A6-415f-80AD-7E09334BB852@exoip.com
Murray, Nicholas Nicholas.Murray Nicholas.Murray@exoip.com
Bower, Piers Piers.Bower Piers.Bower@exoip.com
Grant, Richard Richard.Grant Richard.Grant@exoip.com
Room Tokyo roomtokyo roomtokyo@exoip.com
Dickens, Ruth Ruth.Dickens Ruth.Dickens@exoip.com
Nolan, Sebastian Sebastian.Nolan Sebastian.Nolan@exoip.com
Rees, Zoë Zoe.Rees Zoe.Rees@exoip.com
Set permissions
Ensure that you have the correct permissions set for the administrator account that is going to remove the emails. Otherwise, you will get the below error when using the -DeleteContent parameter.
A parameter cannot be found that matches parameter name 'DeleteContent'.
+ CategoryInfo : InvalidArgument: (:) [Search-Mailbox], ParameterBindingException
+ FullyQualifiedErrorId : NamedParameterNotFound,Search-Mailbox
+ PSComputerName : ex01-2019.exoip.local
Check if the admin account is added to the Discovery Management group.
Get-ADGroupMember "Discovery Management"
Add the administrator account to the Discovery Management group.
Add-ADGroupMember "Discovery Management" "Administrator"
Check if the administrator account is assigned the Mailbox Import Export role.
Get-ManagementRoleAssignment -Role "Mailbox Import Export" -Delegating $false
Add the administrator account to the Mailbox Import Export role.
New-ManagementRoleAssignment -Role "Mailbox Import Export" -User "Administrator"
Important: The new role assignments will not be active until the user logs off and then logs back on to the Exchange Server. If changes have been made in a remote site, you may need to wait for your Active Directory replication interval to complete before the role memberships will be available to user sessions on the Exchange Servers within your site.
Search and delete messages from Exchange
The message that we like to delete from all Exchange user mailboxes is sent from Boris. The subject is: Saying goodbye is never easy.
Search and delete messages from CSV file
We want to search all the users in the CSV file and remove the email with that specific subject. Make sure that the -Force switch is added in the end. Otherwise, you have to keep confirming to remove the message from every mailbox.
Import-Csv "C:\temp\user_mailboxes.csv" | ForEach-Object {Search-Mailbox $_.PrimarySmtpAddress -SearchQuery 'Subject:"Saying goodbye is never easy"' -DeleteContent -Force}
The below output appears.
WARNING: The Search-Mailbox cmdlet returns up to 10000 results per mailbox if a search query is specified. To return more than 10000 results, use the New-MailboxSearch cmdlet or the In-Place eDiscovery & Hold console
in the Exchange Administration Center.
RunspaceId : 188c72af-79d0-4de8-b2bb-f4f5dda01814
Identity : exoip.local/Users/Administrator
TargetMailbox :
Success : True
TargetFolder :
ResultItemsCount : 1
ResultItemsSize : 9.21 KB (9,431 bytes)
WARNING: The Search-Mailbox cmdlet returns up to 10000 results per mailbox if a search query is specified. To return more than 10000 results, use the New-MailboxSearch cmdlet or the In-Place eDiscovery & Hold console
in the Exchange Administration Center.
RunspaceId : 188c72af-79d0-4de8-b2bb-f4f5dda01814
Identity : exoip.local/Company/Users/IT/Ali Tajran
TargetMailbox :
Success : True
TargetFolder :
ResultItemsCount : 1
ResultItemsSize : 9.184 KB (9,404 bytes)
WARNING: The Search-Mailbox cmdlet returns up to 10000 results per mailbox if a search query is specified. To return more than 10000 results, use the New-MailboxSearch cmdlet or the In-Place eDiscovery & Hold console
in the Exchange Administration Center.
RunspaceId : 188c72af-79d0-4de8-b2bb-f4f5dda01814
Identity : exoip.local/Company/Users/Finance/Amanda Morgan
TargetMailbox :
Success : True
TargetFolder :
ResultItemsCount : 1
ResultItemsSize : 9.2 KB (9,421 bytes)
It did search and delete messages from Exchange user mailboxes specified in the CSV file.
Search and delete messages from all mailboxes
If you like to target all user mailboxes without a CSV file, use the Get-Mailbox cmdlet.
Get-Mailbox -ResultSize Unlimited | Search-Mailbox -SearchQuery 'Subject:"Saying goodbye is never easy"' -DeleteContent -Force
The below output appears.
WARNING: The Search-Mailbox cmdlet returns up to 10000 results per mailbox if a search query is specified. To return more than 10000 results, use the New-MailboxSearch cmdlet or the In-Place eDiscovery & Hold console
in the Exchange Administration Center.
RunspaceId : 188c72af-79d0-4de8-b2bb-f4f5dda01814
Identity : exoip.local/Users/Administrator
TargetMailbox :
Success : True
TargetFolder :
ResultItemsCount : 1
ResultItemsSize : 9.21 KB (9,431 bytes)
RunspaceId : 188c72af-79d0-4de8-b2bb-f4f5dda01814
Identity : exoip.local/Company/Users/IT/Ali Tajran
TargetMailbox :
Success : True
TargetFolder :
ResultItemsCount : 1
ResultItemsSize : 9.184 KB (9,404 bytes)
RunspaceId : 188c72af-79d0-4de8-b2bb-f4f5dda01814
Identity : exoip.local/Company/Users/Finance/Amanda Morgan
TargetMailbox :
Success : True
TargetFolder :
ResultItemsCount : 1
ResultItemsSize : 9.2 KB (9,421 bytes)
It did search and delete messages from all Exchange user mailboxes.
Verify the results
Let’s have a look at Christopher’s mailbox. We can confirm that the message is deleted.
The message will not be sent to the deleted items folder. The only way to recover the message is through your backup software.
The message is deleted from all Exchange user mailboxes. Did this work for you?
Keep reading: Delete mailbox database in Exchange Server »
Conclusion
You learned how to search and delete messages from Exchange user mailboxes. Get the message subject that you want to delete. After that, run one of the cmdlets shown in the article to remove the message.
Did you enjoy this article? You may also like Mark all messages as read in Outlook. Don’t forget to follow us and share this article.
Can you do a step by step for a scenario where a phishing email comes in and I want it removed based on keywords in the body like a name. In this example the spam email has no subject or just RE: and it went to a DL which then puts that email in several mailboxes. I’ve tried the MS commands for Searchcompliance but have found the commanline output does not match the EAC displayed items. Any help is appreciated!!