Export (0) Print
Expand All

Search and delete messages

 

Applies to: Exchange Server 2013, Exchange Online

Topic Last Modified: 2014-07-14

You can use the Search-Mailbox cmdlet to search and delete messages from a mailbox.

To search and delete messages in one step, run the Search-Mailbox cmdlet with the DeleteContent switch. However, when you do this, you can't preview search results or generate a log of messages that will be returned by the search, and you may inadvertently delete messages that you didn't intend to. To preview a log of the messages found in the search before they're deleted, run the Search-Mailbox cmdlet with the LogOnly switch.

As an additional safeguard, you can first copy the messages to another mailbox by using the TargetMailbox and TargetFolder parameters. By doing this, you retain a copy of the deleted messages in case you need to access them again.

  • Estimated time to complete: 10 minutes. The actual time may vary depending on the size of the mailbox and the search query.

  • You need to be assigned the following management roles to search for and delete messages in users' mailboxes:

    • Mailbox Search   This role allows you to search for messages across multiple mailboxes in your organization. Administrators aren't assigned this role by default. To assign yourself this role so that you can search mailboxes, add yourself as a member of the Discovery Management role group. See Add a user to the Discovery Management role group.

    • Mailbox Import Export   This role allows you to delete messages from a user's mailbox. By default, this role isn't assigned to any role group. To delete messages from users' mailboxes, you can add the Mailbox Import Export role to the Organization Management role group. For more information, see Add a role to a role group.

  • If the mailbox from which you want to delete messages has single item recovery enabled, you must first disable the feature.

  • If the mailbox from which you want to delete messages is placed on litigation hold, we recommend that you check with your records management or legal department before removing the hold and deleting the mailbox content. After you obtain approval, follow the steps listed in the topic Clean up the Recoverable Items folder.

  • You can't use the Exchange admin center (EAC) to perform these procedures. You must use the Shell.

This example searches April Stewart's mailbox for messages that contain the phrase "Your bank statement" in the Subject field and logs the search results in the SearchAndDeleteLog folder of the administrator's mailbox. Messages aren't copied to or deleted from the target mailbox.

Search-Mailbox -Identity "April Stewart" -SearchQuery "Subject:'Your bank statement'" -TargetMailbox "administrator" -TargetFolder "SearchAndDeleteLog" -LogOnly -LogLevel Full

For detailed syntax and parameter information, see Search-Mailbox.

This example searches April Stewart's mailbox for messages that contain the phrase "Your bank statement" in the Subject field and deletes the messages from the source mailbox without copying the search results to another folder. As previously explained, you need to be assigned the Mailbox Import Export management role to delete messages from a user's mailbox.

CautionCaution:
When you use the Search-Mailbox cmdlet with the DeleteContent switch, messages are permanently deleted from the source mailbox. Before you permanently delete messages, we recommend that you either use the LogOnly switch to generate a log of the messages found in the search before they're deleted or copy the messages to another mailbox before deleting them from the source mailbox.
Search-Mailbox -Identity "April Stewart" -SearchQuery "Subject:'Your bank statement'" -DeleteContent

This example searches April Stewart's mailbox for messages that contain the phrase "Your bank statement" in the Subject field, copies the search results to the folder AprilStewart-DeletedMessages in the mailbox BackupMailbox, and deletes the messages from April's mailbox.

Search-Mailbox -Identity "April Stewart" -SearchQuery "Subject:'Your bank statement'" -TargetMailbox "BackupMailbox" -TargetFolder "AprilStewart-DeletedMessages" -LogLevel Full -DeleteContent

For detailed syntax and parameter information, see Search-Mailbox.

 
Was this page helpful?
(1500 characters remaining)
Thank you for your feedback
Show:
© 2014 Microsoft