Remove specific messages from Exchange 2010 Server

Sometimes Exchange administrator need to remove messages that fit specific criteria from large number of mailboxes or from Exchange transport queues.

Removing messages from Exchange mailboxes:

To perform remove message operation from mailboxes, in Exchange 2010 RBAC Mailbox Export Import role must be assigned to the admin account. To remove messages from Exchange 2010 mailboxes we will use Search-Mailbox cmdlet.

Account used to export data from mailboxes must be:

• an Exchange Server Administrator
• member of local Administrators group of target server
• Full Access permission assigned to the mailboxes

To add RBAC role to user Admin:

New-ManagementRoleAssignment –Role “Mailbox Import Export” –User “Admin”

Sometimes you will need to add necessary permissions for user Admin to all mailboxes, then we can use:

Get-Mailbox -ResultSize unlimited | Add-MailboxPermissions -User Admin -AccessRights FullAccess -InheritanceType all

After completed removing operations, we have to remove this permissions like below:

Get-Mailbox -ResultSize unlimited |Remove-MailboxPermissions -User Admin -AccessRights FullAccess -InheritanceType all

To search all messages with specified subject like “Important Message” of all mailboxes on server MBX1 we have to use example like below:

Get-Mailbox -Server  "MBX1" -ResultSize Unlimited | Search-Mailbox -SearchQuery 'Subject:"*Important Message*" -targetmailbox "*SearchMailbox*" -targetfolder "*SearchFolder*" -logonly -loglevel full

The above code will send logs to the TargetMailbox and folder targetfolder.

To delete all messages which meet specific criteria, we use:

Get-Mailbox -Server  "MBX1" -ResultSize Unlimited | Search-Mailbox -SearchQuery 'Subject:"*Subject*" and Body:"*Body*"' -deletecontent

But if we want first copy all messages that meet search criteria and then delete them from all mailboxes we can use:

Get-Mailbox -Server  "MBX1" -ResultSize Unlimited | Search-Mailbox -SearchQuery 'Subject:"*Subject*" and Body:"*Body*"' -targetmailbox "*SearchMailbox*" -targetfolder "*SearchFolder*" -loglevel full -deletecontent

If we use -Force we will avoid confirmation dialog

Get-Mailbox -Server  "MBX1" -ResultSize Unlimited | Search-Mailbox -SearchQuery 'Subject:"*Subject*" and Body:"*Body*"' -targetmailbox "*SearchMailbox*" -targetfolder "*SearchFolder*" -loglevel full -deletecontent -Force

To copy and remove all messages sent between September 20 and September 25 we can use:

Search-Mailbox -identity "mailboxname" -SearchQuery "Sent:> $('2012-09-20') and Sent:< $('2012-09-25')" -Confirm:$false -Force -TargetMailbox "targetuser" -TargetFolder "SearchAndDeleteLog" -LogLevel Full -DeleteContent -Force

To remove from mailbox messages received which are older than 2 days we can use:

Search-Mailbox -identity JohnSmith -searchQuery "Received:< $(get-date).addDays(-2)" -DeleteContent -whatif

If we add -WhatIf at the end of above code, we will only see results without deleting messages from mailbox.

To remove all messages received between dates:

Search-Mailbox -Identity “mailbox_name” -SearchQuery “Received:> $(’10/01/2012') and Received:< $(’10/05/2012')” -DeleteContent

 Remove messages from Exchange 2010 Transport Queues:

To suspend messages sent from specified email address we can use:

Get-TransportServer | Get-Queue | Get-Message -ResultSize unlimited | Where {$_.fromaddress -like "*virus@domain.com*"} | Susspend-Message

To remove messages from Transport Queue sent from specified email address we can use:

Get-TransportServer | Get-Queue | Get-Message -ResultSize unlimited | Where {$_.fromaddress -like "*virus@domain.com*"} | Remove-Message -WithNDR $False -Confirm $False

To remove all messages from Exchange 2010 Transport Queue with specified subject we can use:

Get-TransportServer | Get-Queue | Get-Message -ResultSize unlimited | Where {$_.Subject -like "*virus*"} | Remove-Message -WithNDR $False -Confirm $False