Any suggestions? Export (0) Print
Expand All

Search for and delete messages in Exchange 2016

 

Applies to: Exchange Server 2016

Topic Last Modified: 2016-02-02

You can use the Search-Mailbox cmdlet to search for and permanently delete (purge) messages from a mailbox. This can help you find and remove potentially harmful or high-risk email, such as:

  • Messages that contain a dangerous attachment or virus

  • Phishing messages

  • Messages that contain sensitive data

To search for and delete messages in one step, run the Search-Mailbox cmdlet with the DeleteContent switch. However when you do this, you can't preview the search results or generate a log that lists messages that will be returned by the search and then purged from the user's mailbox. This might result in inadvertently deleting messages that you didn't intend to delete. To preview a log of the messages found in the search before they're deleted, run the Search-Mailbox cmdlet with the LogOnly switch.

As an additional safeguard, you can first copy the messages to another mailbox by using the TargetMailbox and TargetFolder parameters. By doing this, you retain a copy of the deleted messages in case you need to access them again.

  • You need to be assigned both of the following management roles to search for and delete messages in users' mailboxes:

    • Mailbox Search   This role allows you to search for messages across multiple mailboxes in your organization. Administrators aren't assigned this role by default. To assign yourself this role so that you can search mailboxes, add yourself as a member of the Discovery Management role group. See Assign eDiscovery permissions in Exchange 2016.

    • Mailbox Import Export   This role allows you to delete messages from a user's mailbox. By default, this role isn't assigned to any role group. To delete messages from users' mailboxes, you can add the Mailbox Import Export role to the Organization Management role group. For more information, see the "Add a role to a role group" section in Manage role groups.

  • If the mailbox from which you want to delete messages has single item recovery enabled, you must first disable the feature. For more information, see Enable or disable single item recovery for a mailbox.

  • If the mailbox from which you want to delete messages is placed on Litigation Hold or In-Place Hold, we recommend that you check with your records management or legal department before removing the hold and deleting the mailbox content. After you obtain approval, follow the steps listed in the topic Clean up the Recoverable Items folder.

  • You can't use the Exchange admin center (EAC) to perform these procedures. You have to use the Shell.

  • For detailed syntax and parameter information, see Search-Mailbox.

This example searches April Stewart's mailbox for messages that contain the phrase "Your bank statement" in the Subject field and logs the search results in the SearchAndDeleteLog folder of the administrator's mailbox. Messages aren't copied to or deleted from the target mailbox.

Search-Mailbox -Identity "April Stewart" -SearchQuery 'Subject:"Your bank statement"' -TargetMailbox administrator -TargetFolder "SearchAndDeleteLog" -LogOnly -LogLevel Full

This example searches all mailboxes in the organization for messages that have any type of attached file that contains the word "Trojan" in the filename and sends a log message to the administrator's mailbox.

Get-Mailbox -ResultSize unlimited | Search-Mailbox -SearchQuery attachment:trojan* -TargetMailbox administrator -TargetFolder "SearchAndDeleteLog" -LogOnly -LogLevel Full

Return to top

importantImportant:
When you use the Search-Mailbox cmdlet with the DeleteContent switch, messages are permanently deleted from the source mailbox. Before you permanently delete messages, we recommend that you either use the LogOnly switch to generate a log of the messages found in the search before they're deleted or copy the messages to another mailbox before deleting them from the source mailbox.

This example searches April Stewart's mailbox for messages that contain the phrase "Your bank statement" in the Subject field and deletes the messages from the source mailbox without copying the search results to another folder. As previously explained, you need to be assigned the Mailbox Import Export management role to delete messages from a user's mailbox.

Search-Mailbox -Identity "April Stewart" -SearchQuery 'Subject:"Your bank statement"' -DeleteContent

This example searches April Stewart's mailbox for messages that contain the phrase "Your bank statement" in the Subject field, copies the search results to the folder AprilStewart-DeletedMessages in the mailbox BackupMailbox, and deletes the messages from April's mailbox.

Search-Mailbox -Identity "April Stewart" -SearchQuery 'Subject:"Your bank statement"' -TargetMailbox "BackupMailbox" -TargetFolder "AprilStewart-DeletedMessages" -LogLevel Full -DeleteContent

This example searches all mailboxes in the organization for messages with the subject line "Download this file", and then permanently deletes them.

Get-Mailbox -ResultSize unlimited | Search-Mailbox -SearchQuery 'Subject:"Download this file"' -DeleteContent

Return to top

 
Show:
© 2016 Microsoft