If you have thousands of mailboxes to migrate, you like to check which mailboxes are…
Search and delete email from Exchange user mailbox
A user from finance sent an email to the wrong user and asks if it’s possible to delete the email from Exchange Server. The user sent the email to an internal user of the organization. There is panic because the user should not get that email. You will be asked if you can delete that message from the user inbox. This article will teach you how to search and delete email from Exchange user mailbox with PowerShell.
Table of contents
Information
In this article, the user Amanda Morgan (amanda.morgan@exoip.com) sent an email to the user Christopher Payne (christopher.payne@exoip.com) at date 10-09-2020 (9 October 2020). We don’t know the subject. But we have an estimated time when she sent the email. That’s around 00:00. How are we going to accomplish the mission?
Do you like to search and delete the email from all mailboxes? Read the article Search and delete messages from Exchange user mailboxes.
Get email subject
First, we need to search for all sent emails from Amanda to Christopher. If we have found the sent emails, we can get that specific email with the subject. Before we start, make sure that there is a temp folder on your C:\drive. If not, create a folder with the name temp.
Filter specific date
Run Exchange Management Shell as administrator. Make use of the Get-MessageTrackingLog cmdlet to get a log of all messages from Amanda to Christopher on that day.
[PS] C:\>Get-MessageTrackingLog -Start "10/09/2020 00:00:00" -End "10/09/2020 23:59:59" -Sender "amanda.morgan@exoip.com" -Recipients "christopher.payne@exoip.com" -ResultSize Unlimited | Format-Table -AutoSize
If the user has sent many emails, it won’t be easy to find that particular email. Luckily, PowerShell is powerful, and we can filter the result more to our liking. Let’s see how we can do that.
Filter specific date and time
Search for a specific time, in our case, from 00:00:00 – 00:30:00.
[PS] C:\>Get-MessageTrackingLog -Start "10/09/2020 00:00:00" -End "10/09/2020 00:30:00" -Sender "amanda.morgan@exoip.com" -Recipients "christopher.payne@exoip.com" -ResultSize Unlimited | Format-Table -AutoSize
Timestamp EventId Source Sender Recipients MessageSubject
--------- ------- ------ ------ ---------- --------------
10/9/2020 12:02:09 AM HAREDIRECTFAIL SMTP Amanda.Morgan@exoip.com {Christopher.Payne@exoip.com} Earnings per month
10/9/2020 12:02:09 AM RECEIVE SMTP Amanda.Morgan@exoip.com {Christopher.Payne@exoip.com} Earnings per month
10/9/2020 12:02:09 AM AGENTINFO AGENT Amanda.Morgan@exoip.com {Christopher.Payne@exoip.com} Earnings per month
10/9/2020 12:02:09 AM SEND SMTP Amanda.Morgan@exoip.com {Christopher.Payne@exoip.com} Earnings per month
10/9/2020 12:02:09 AM RECEIVE STOREDRIVER Amanda.Morgan@exoip.com {Christopher.Payne@exoip.com} Earnings per month
10/9/2020 12:02:09 AM SUBMIT STOREDRIVER Amanda.Morgan@exoip.com {Christopher.Payne@exoip.com} Earnings per month
10/9/2020 12:02:09 AM DELIVER STOREDRIVER Amanda.Morgan@exoip.com {Christopher.Payne@exoip.com} Earnings per month
Use Out-GridView cmdlet
Use the Out-GridView cmdlet to send the output to an interactive table in a separate window.
[PS] C:\>Get-MessageTrackingLog -Start "10/09/2020 00:00:00" -End "10/09/2020 00:30:00" -Sender "amanda.morgan@exoip.com" -Recipients "christopher.payne@exoip.com" -ResultSize Unlimited | Out-GridView
The output will show as follows.
Export to CSV file
We like to have the information exported to a CSV file.
[PS] C:\>Get-MessageTrackingLog -Start "10/09/2020 00:00:00" -End "10/09/2020 00:30:00" -Sender "amanda.morgan@exoip.com" -Recipients "christopher.payne@exoip.com" -ResultSize Unlimited | Select Timestamp,EventId,Source,Sender,@{Name='Recipients';Expression={[string]::join(";", ($_.recipients))}},MessageSubject | Export-Csv "c:\temp\get_list.csv" -NoTypeInformation
Open the CSV file with your favorite application. In our example, Microsoft Excel.
Now that we have the subject, we can remove Amanda’s email from Christopher’s mailbox.
Delete email from Exchange
When we sign in to Outlook as the user Christopher, we can see the email from Amanda.
Run the following command to delete the email from Christopher’s mailbox. Confirm with Y and press Enter.
[PS] C:\>Search-Mailbox -Identity "christopher.payne@exoip.com" -SearchQuery 'Subject:"Earnings per month"' -DeleteContent
WARNING: The Search-Mailbox cmdlet returns up to 10000 results per mailbox if a search query is specified. To return more than 10000 results, use the New-MailboxSearch cmdlet or the In-Place eDiscovery & Hold console
in the Exchange Administration Center.
Confirm
Deleting content from mailboxes christopher.payne@exoip.com
[Y] Yes [A] Yes to All [N] No [L] No to All [?] Help (default is "Y"): Y
RunspaceId : 615c7ca9-d995-4908-800f-be75565ece89
Identity : exoip.local/Company/Users/Finance/Christopher Payne
TargetMailbox :
Success : True
TargetFolder :
ResultItemsCount : 1
ResultItemsSize : 7.732 KB (7,918 bytes)
If you don’t want to confirm, run the same command to delete the email from Exchange user mailbox, but this time with the -Force switch. It will run the command and remove the email, without asking to confirm.
[PS] C:\>Search-Mailbox -Identity "christopher.payne@exoip.com" -SearchQuery 'Subject:"Earnings per month"' -DeleteContent -Force
WARNING: The Search-Mailbox cmdlet returns up to 10000 results per mailbox if a search query is specified. To return more than 10000 results, use the New-MailboxSearch cmdlet or the In-Place eDiscovery & Hold console
in the Exchange Administration Center.
RunspaceId : 615c7ca9-d995-4908-800f-be75565ece89
Identity : exoip.local/Company/Users/Finance/Christopher Payne
TargetMailbox :
Success : True
TargetFolder :
ResultItemsCount : 1
ResultItemsSize : 7.732 KB (7,918 bytes)
The email is deleted successfully from the mailbox.
Verify the results
Have a look at Christopher’s mailbox. The email is deleted.
Good to know is that the email will get deleted completely. It will not get moved to the Deleted Items of the user. Also, the user can’t recover it from deleted items.
Email is deleted from the user mailbox in Exchange Server. Did this work for you?
Read more: Test internal mail flow in Exchange Server »
Conclusion
In this article, you learned how to delete email from Exchange user mailbox using PowerShell. We started by refining the search result with PowerShell to find the email subject that was sent. After that, we did run the Search-Mailbox cmdlet, including -DeleteContent switch to remove the email from the user mailbox.
Did you enjoy this article? You may also like Create user mailbox in Exchange Server. Don’t forget to follow us and share this article.
Hi Ali,
How are you ? I have a Exchange 2019. I want to delete items between specific date for all mailbox accounts. For example, Deleting all items before 2020. How sould I write command on Exchange shell ? Can you help me ?
Hello Ali,
I have faced an issue. subject in Arabic language which not work in PowerShell. how can i handle this case ?
Shall i use another search criteria ?
Despite search-mailbox being deprecated it still appeared to work for me.
Yours is the only guide that was just to the point instead of going round the houses. I only wanted to delete one e-mail from 10 mailboxes. Now done. Thanks.
And your images match your commands. So many were showing what the commands were, then a completely different command layout in their image. More people should show the command structure, then an example, then show that example running in the image. Not show an example then run a totally different example in the image.
Again, your guide was the only decent one.
Needed the solution for wipe out a mailbox completely.
Search-Mailbox has been deprecated and Content Search doesn’t have the ability to delete wipe out the mailbox content (10 items per mailbox as per article – also says it’s not meant for clean up mailbox scenario)
what’s your take on such cases?
PS – Great stuff anyways, love your work!!
Search-mailbox is deprecated.
The Search-Mailbox cmdlet still works in Exchange on-premises. In Exchange Online (Office 365), since April 01, 2020, the Search-Mailbox cmdlet is deprecated in favor of New-ComplianceSearch and related eDiscovery cmdlets.