Skip to content

Search and delete email from Exchange user mailbox

A user from finance sent an email to the wrong user and asks if it’s possible to delete the email from Exchange Server. The user sent the email to an internal user of the organization. There is panic because the user should not get that email. You will be asked if you can delete that message from the user inbox. This article will teach you how to search and delete email from Exchange user mailbox with PowerShell.

Information

In this article, the user Amanda Morgan (amanda.morgan@exoip.com) sent an email to the user Christopher Payne (christopher.payne@exoip.com) at date 10-09-2020 (9 October 2020). We don’t know the subject. But we have an estimated time when she sent the email. That’s around 00:00. How are we going to accomplish the mission?

Do you like to search and delete the email from all mailboxes? Read the article Search and delete messages from Exchange user mailboxes.

Get email subject

First, we need to search for all sent emails from Amanda to Christopher. If we have found the sent emails, we can get that specific email with the subject. Before we start, make sure that there is a temp folder on your C:\drive. If not, create a folder with the name temp.

Filter specific date

Run Exchange Management Shell as administrator. Make use of the Get-MessageTrackingLog cmdlet to get a log of all messages from Amanda to Christopher on that day.

[PS] C:\>Get-MessageTrackingLog -Start "10/09/2020 00:00:00" -End "10/09/2020 23:59:59" -Sender "amanda.morgan@exoip.com" -Recipients "christopher.payne@exoip.com" -ResultSize Unlimited | Format-Table -AutoSize

If the user has sent many emails, it won’t be easy to find that particular email. Luckily, PowerShell is powerful, and we can filter the result more to our liking. Let’s see how we can do that.

Filter specific date and time

Search for a specific time, in our case, from 00:00:00 – 00:30:00.

[PS] C:\>Get-MessageTrackingLog -Start "10/09/2020 00:00:00" -End "10/09/2020 00:30:00" -Sender "amanda.morgan@exoip.com" -Recipients "christopher.payne@exoip.com" -ResultSize Unlimited | Format-Table -AutoSize

Timestamp             EventId        Source      Sender                  Recipients                    MessageSubject
---------             -------        ------      ------                  ----------                    --------------
10/9/2020 12:02:09 AM HAREDIRECTFAIL SMTP        Amanda.Morgan@exoip.com {Christopher.Payne@exoip.com} Earnings per month
10/9/2020 12:02:09 AM RECEIVE        SMTP        Amanda.Morgan@exoip.com {Christopher.Payne@exoip.com} Earnings per month
10/9/2020 12:02:09 AM AGENTINFO      AGENT       Amanda.Morgan@exoip.com {Christopher.Payne@exoip.com} Earnings per month
10/9/2020 12:02:09 AM SEND           SMTP        Amanda.Morgan@exoip.com {Christopher.Payne@exoip.com} Earnings per month
10/9/2020 12:02:09 AM RECEIVE        STOREDRIVER Amanda.Morgan@exoip.com {Christopher.Payne@exoip.com} Earnings per month
10/9/2020 12:02:09 AM SUBMIT         STOREDRIVER Amanda.Morgan@exoip.com {Christopher.Payne@exoip.com} Earnings per month
10/9/2020 12:02:09 AM DELIVER        STOREDRIVER Amanda.Morgan@exoip.com {Christopher.Payne@exoip.com} Earnings per month

Use Out-GridView cmdlet

Use the Out-GridView cmdlet to send the output to an interactive table in a separate window.

[PS] C:\>Get-MessageTrackingLog -Start "10/09/2020 00:00:00" -End "10/09/2020 00:30:00" -Sender "amanda.morgan@exoip.com" -Recipients "christopher.payne@exoip.com" -ResultSize Unlimited | Out-GridView

The output will show as follows.

Search and delete email from Exchange user mailbox Out-GridView

Export to CSV file

We like to have the information exported to a CSV file.

[PS] C:\>Get-MessageTrackingLog -Start "10/09/2020 00:00:00" -End "10/09/2020 00:30:00" -Sender "amanda.morgan@exoip.com" -Recipients "christopher.payne@exoip.com" -ResultSize Unlimited | Select Timestamp,EventId,Source,Sender,@{Name='Recipients';Expression={[string]::join(";", ($_.recipients))}},MessageSubject | Export-Csv "c:\temp\get_list.csv" -NoTypeInformation

Open the CSV file with your favorite application. In our example, Microsoft Excel.

CSV file in Excel

Now that we have the subject, we can remove Amanda’s email from Christopher’s mailbox.

Delete email from Exchange

When we sign in to Outlook as the user Christopher, we can see the email from Amanda.

Search and delete email from Exchange user mailbox before

Run the following command to delete the email from Christopher’s mailbox. Confirm with Y and press Enter.

[PS] C:\>Search-Mailbox -Identity "christopher.payne@exoip.com" -SearchQuery 'Subject:"Earnings per month"' -DeleteContent
WARNING: The Search-Mailbox cmdlet returns up to 10000 results per mailbox if a search query is specified. To return more than 10000 results, use the New-MailboxSearch cmdlet or the In-Place eDiscovery & Hold console
in the Exchange Administration Center.

Confirm
Deleting content from mailboxes christopher.payne@exoip.com
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [?] Help (default is "Y"): Y


RunspaceId       : 615c7ca9-d995-4908-800f-be75565ece89
Identity         : exoip.local/Company/Users/Finance/Christopher Payne
TargetMailbox    :
Success          : True
TargetFolder     :
ResultItemsCount : 1
ResultItemsSize  : 7.732 KB (7,918 bytes)

If you don’t want to confirm, run the same command to delete the email from Exchange user mailbox, but this time with the -Force switch. It will run the command and remove the email, without asking to confirm.

[PS] C:\>Search-Mailbox -Identity "christopher.payne@exoip.com" -SearchQuery 'Subject:"Earnings per month"' -DeleteContent -Force
WARNING: The Search-Mailbox cmdlet returns up to 10000 results per mailbox if a search query is specified. To return more than 10000 results, use the New-MailboxSearch cmdlet or the In-Place eDiscovery & Hold console
in the Exchange Administration Center.


RunspaceId       : 615c7ca9-d995-4908-800f-be75565ece89
Identity         : exoip.local/Company/Users/Finance/Christopher Payne
TargetMailbox    :
Success          : True
TargetFolder     :
ResultItemsCount : 1
ResultItemsSize  : 7.732 KB (7,918 bytes)

The email is deleted successfully from the mailbox.

Verify the results

Have a look at Christopher’s mailbox. The email is deleted.

Search and delete email from Exchange user mailbox after

Good to know is that the email will get deleted completely. It will not get moved to the Deleted Items of the user. Also, the user can’t recover it from deleted items.

Recover deleted items

Email is deleted from the user mailbox in Exchange Server. Did this work for you?

Read more: Test internal mail flow in Exchange Server »

Conclusion

In this article, you learned how to delete email from Exchange user mailbox using PowerShell. We started by refining the search result with PowerShell to find the email subject that was sent. After that, we did run the Search-Mailbox cmdlet, including -DeleteContent switch to remove the email from the user mailbox.

Did you enjoy this article? You may also like Create user mailbox in Exchange Server. Don’t forget to follow us and share this article.

ALI TAJRAN

ALI TAJRAN

ALI TAJRAN is a passionate IT Architect, IT Consultant, and Microsoft Certified Trainer. He started Information Technology at a very young age, and his goal is to teach and inspire others. Read more »

This Post Has 6 Comments

  1. Hi Ali,

    How are you ? I have a Exchange 2019. I want to delete items between specific date for all mailbox accounts. For example, Deleting all items before 2020. How sould I write command on Exchange shell ? Can you help me ?

  2. Hello Ali,
    I have faced an issue. subject in Arabic language which not work in PowerShell. how can i handle this case ?
    Shall i use another search criteria ?

  3. Despite search-mailbox being deprecated it still appeared to work for me.

    Yours is the only guide that was just to the point instead of going round the houses. I only wanted to delete one e-mail from 10 mailboxes. Now done. Thanks.

    And your images match your commands. So many were showing what the commands were, then a completely different command layout in their image. More people should show the command structure, then an example, then show that example running in the image. Not show an example then run a totally different example in the image.

    Again, your guide was the only decent one.

  4. Needed the solution for wipe out a mailbox completely.
    Search-Mailbox has been deprecated and Content Search doesn’t have the ability to delete wipe out the mailbox content (10 items per mailbox as per article – also says it’s not meant for clean up mailbox scenario)
    what’s your take on such cases?

    PS – Great stuff anyways, love your work!!

    1. The Search-Mailbox cmdlet still works in Exchange on-premises. In Exchange Online (Office 365), since April 01, 2020, the Search-Mailbox cmdlet is deprecated in favor of New-ComplianceSearch and related eDiscovery cmdlets.

Leave a Reply

Your email address will not be published. Required fields are marked *