skip to Main Content

Search and delete email from Exchange user mailbox

A user from finance sent an email to the wrong user and asks if it’s possible to delete the email from Exchange Server. The user sent the email to an internal user of the organization. There is panic because the user should not get that email. You will be asked if you can delete that message from the user inbox. This article will teach you how to search and delete email from Exchange user mailbox with PowerShell.

Information

In this article, the user Amanda Morgan (amanda.morgan@exoip.com) sent an email to the user Christopher Payne (christopher.payne@exoip.com) at date 10-09-2020 (9 October 2020). We don’t know the subject. But we have an estimated time when she sent the email. That’s around 00:00. How are we going to accomplish the mission?

Do you like to search and delete the email from all mailboxes? Read the article Search and delete messages from Exchange user mailboxes.

Get email subject

First, we need to search for all sent emails from Amanda to Christopher. If we have found the sent emails, we can get that specific email with the subject. Before we start, make sure that there is a temp folder on your C:\drive. If not, create a folder with the name temp.

Filter specific date

Run Exchange Management Shell as administrator. Make use of the Get-MessageTrackingLog cmdlet to get a log of all messages from Amanda to Christopher on that day.

[PS] C:\>Get-MessageTrackingLog -Start "10/09/2020 00:00:00" -End "10/09/2020 23:59:59" -Sender "amanda.morgan@exoip.com" -Recipients "christopher.payne@exoip.com" -ResultSize Unlimited | Format-Table -AutoSize

If the user has sent many emails, it won’t be easy to find that particular email. Luckily, PowerShell is powerful, and we can filter the result more to our liking. Let’s see how we can do that.

Filter specific date and time

Search for a specific time, in our case, from 00:00:00 – 00:30:00.

[PS] C:\>Get-MessageTrackingLog -Start "10/09/2020 00:00:00" -End "10/09/2020 00:30:00" -Sender "amanda.morgan@exoip.com" -Recipients "christopher.payne@exoip.com" -ResultSize Unlimited | Format-Table -AutoSize

Timestamp             EventId        Source      Sender                  Recipients                    MessageSubject
---------             -------        ------      ------                  ----------                    --------------
10/9/2020 12:02:09 AM HAREDIRECTFAIL SMTP        Amanda.Morgan@exoip.com {Christopher.Payne@exoip.com} Earnings per month
10/9/2020 12:02:09 AM RECEIVE        SMTP        Amanda.Morgan@exoip.com {Christopher.Payne@exoip.com} Earnings per month
10/9/2020 12:02:09 AM AGENTINFO      AGENT       Amanda.Morgan@exoip.com {Christopher.Payne@exoip.com} Earnings per month
10/9/2020 12:02:09 AM SEND           SMTP        Amanda.Morgan@exoip.com {Christopher.Payne@exoip.com} Earnings per month
10/9/2020 12:02:09 AM RECEIVE        STOREDRIVER Amanda.Morgan@exoip.com {Christopher.Payne@exoip.com} Earnings per month
10/9/2020 12:02:09 AM SUBMIT         STOREDRIVER Amanda.Morgan@exoip.com {Christopher.Payne@exoip.com} Earnings per month
10/9/2020 12:02:09 AM DELIVER        STOREDRIVER Amanda.Morgan@exoip.com {Christopher.Payne@exoip.com} Earnings per month

Use Out-GridView cmdlet

Use the Out-GridView cmdlet to send the output to an interactive table in a separate window.

[PS] C:\>Get-MessageTrackingLog -Start "10/09/2020 00:00:00" -End "10/09/2020 00:30:00" -Sender "amanda.morgan@exoip.com" -Recipients "christopher.payne@exoip.com" -ResultSize Unlimited | Out-GridView

The output will show as follows.

Search and delete email from Exchange user mailbox Out-GridView

Export to CSV file

We like to have the information exported to a CSV file.

[PS] C:\>Get-MessageTrackingLog -Start "10/09/2020 00:00:00" -End "10/09/2020 00:30:00" -Sender "amanda.morgan@exoip.com" -Recipients "christopher.payne@exoip.com" -ResultSize Unlimited | Select Timestamp,EventId,Source,Sender,@{Name='Recipients';Expression={[string]::join(";", ($_.recipients))}},MessageSubject | Export-CSV c:\temp\get_list.csv -NoTypeInformation

Open the CSV file with your favorite application. In our example, Microsoft Excel.

CSV file in Excel

Now that we have the subject, we can remove Amanda’s email from Christopher’s mailbox.

Delete email from Exchange

When we log into Outlook as the user Christopher, we can see the email from Amanda.

Search and delete email from Exchange user mailbox before

Run the following command to delete the email from Christopher’s mailbox. Confirm with Y and press Enter.

[PS] C:\>Search-Mailbox -Identity "christopher.payne@exoip.com" -SearchQuery 'Subject:"Earnings per month"' -DeleteContent
WARNING: The Search-Mailbox cmdlet returns up to 10000 results per mailbox if a search query is specified. To return more than 10000 results, use the New-MailboxSearch cmdlet or the In-Place eDiscovery & Hold console
in the Exchange Administration Center.

Confirm
Deleting content from mailboxes christopher.payne@exoip.com
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [?] Help (default is "Y"): Y


RunspaceId       : 615c7ca9-d995-4908-800f-be75565ece89
Identity         : exoip.local/Company/Users/Finance/Christopher Payne
TargetMailbox    :
Success          : True
TargetFolder     :
ResultItemsCount : 1
ResultItemsSize  : 7.732 KB (7,918 bytes)

If you don’t want to confirm, run the same command to delete the email from Exchange user mailbox, but this time with the -Force switch. It will run the command and remove the email, without asking to confirm.

[PS] C:\>Search-Mailbox -Identity "christopher.payne@exoip.com" -SearchQuery 'Subject:"Earnings per month"' -DeleteContent -Force
WARNING: The Search-Mailbox cmdlet returns up to 10000 results per mailbox if a search query is specified. To return more than 10000 results, use the New-MailboxSearch cmdlet or the In-Place eDiscovery & Hold console
in the Exchange Administration Center.


RunspaceId       : 615c7ca9-d995-4908-800f-be75565ece89
Identity         : exoip.local/Company/Users/Finance/Christopher Payne
TargetMailbox    :
Success          : True
TargetFolder     :
ResultItemsCount : 1
ResultItemsSize  : 7.732 KB (7,918 bytes)

The email is deleted successfully from the mailbox.

Verify the results

Have a look at Christopher’s mailbox. The email is deleted.

Search and delete email from Exchange user mailbox after

Good to know is that the email will get deleted completely. It will not get moved to the Deleted Items of the user. Also, the user can’t recover it from deleted items.

Search and delete email from Exchange user mailbox recover deleted items

Email is deleted from the user mailbox in Exchange Server. Did this work for you?

Read more: Test internal mail flow in Exchange Server 2016 »

Conclusion

In this article, you learned how to delete email from Exchange user mailbox using PowerShell. We started by refining the search result with PowerShell to find the email subject that was sent. After that, we did run the Search-Mailbox cmdlet, including -DeleteContent switch to remove the email from the user mailbox.

Did you enjoy this article? You may also like Create user mailbox in Exchange 2016. Don’t forget to follow us and share this article.

ALI TAJRAN

ALI TAJRAN

ALI TAJRAN is a passionate IT Architect, IT Consultant, and Microsoft Certified Trainer. He started Information Technology at a very young age, and his goal is to teach and inspire others. Read more »

This Post Has 2 Comments

    1. The Search-Mailbox cmdlet still works in Exchange on-premises. In Exchange Online (Office 365), since April 01, 2020, the Search-Mailbox cmdlet is deprecated in favor of New-ComplianceSearch and related eDiscovery cmdlets.

Leave a Reply

Your email address will not be published. Required fields are marked *

Back To Top