How to delete e-mail from all exchange 2007 mailboxes

Posted on 2014-02-10
Medium Priority
Last Modified: 2014-02-10
I need to delete a specific e-mail from all mailboxes in my exchange 2007 organization. The user sent out an e-mail that needs to be deleted and then sent a recall to outlook. Most of the recalls failed. Then the user sent another e-mail with identical subject and body with the correct attachments. I need to delete the first e-mail with the wrong attachment. I tried using the following commands.

get-mailbox | Export-Mailbox –ContentKeywords "message" –TargetMailbox Administrator –TargetFolder 'MyData' –DeleteContent

I also tried the subject switch but when I run these commands it appears to be pulling over much more then just the one e-mail per user that needs to be deleted. This was discouraging so I canceled it because I didn't want to accidentally delte e-mails from several users.

What is the best/easiest way to delete the one specific e-mail without catching everything else that might have a similar keyword?


Question by:JustinGSEIWI
  • 3
  • 3

Author Comment

ID: 39847783
I used this link.


I also found this text in the link.

"It should also be noted that as long as you are running Exchange 2007 SP2, the ‘keyword’ command will catch all mail items that contain the keyword ANYWHERE in the field, regardless of spacing. So for example, if you are using -SubjectKeywords “Viagra” this will be a hit for “Viagra Cheap”, “Get yourViagraHere” and “     **  Viagra  **”."

This must of been the issue I had with other e-mails that were unrelated being deleted from the users mailbox. I need a way to just delete one specific e-mail, not all e-mails with the same keyboards.
LVL 53

Assisted Solution

by:Will Szymkowski
Will Szymkowski earned 1000 total points
ID: 39847837
You are using the most appropriate method cmdlet for removing the content. I would just tighten the command to only look for a specific data/time. You can use -StartDate and -EndData and you can also use -SenderKeywords.

This will narrow your search results for you so that you can delete the appropriate email/s needed.

Use get-help export-mailbox -full and look at the -StartDate, -EndDate and -SenderKeywords switches.

LVL 35

Accepted Solution

Joseph Daly earned 1000 total points
ID: 39847840
I would give this a shot.

get-mailbox | Export-Mailbox –ContentKeywords "message" –TargetMailbox Administrator –TargetFolder 'MyData' -startdate (date/time) -enddate (date/time) –DeleteContent

You can put in the start and end date to specify a really small window. Hopefuly the person who sent this message did not send them immediately after each other. I would say if you had a window of a minute or so you should be ok.
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.


Author Comment

ID: 39847949
I am trying the following command now.

get-mailbox | Export-Mailbox –ContentKeywords "message" –TargetMailbox Administrator –TargetFolder 'MyData' -startdate (date/time) -enddate (date/time) –DeleteContent

I am going to use an acronym in the e-mail subject because that would not of been used very often. I am also doing a start date or yesterday so it will parse all e-mails today. It is hard to narrow a window because the user did a delayed send for 8am this morning but the e-mail is time stamped in my inbox at 8:17, which is when the user did the recall.

I am testing it on my inbox and it says it is moving message deleted items 390/40984. I read this as it is moving my entire deleted items to the admin mailbox. Is that correct or no? This is was discouraged me initially, I didn't want all e-mails being deleted from the users inbox.
LVL 35

Expert Comment

by:Joseph Daly
ID: 39847959
For your content keywords switch are you using a single word or phrase? I believe you can use a phrase in the email that way it only targets the messages you are interested in.

Author Comment

ID: 39847973
I tried the phrase but then it started deleting other e-mails that matched the words in the phrase. Even though I used the start date command, it is still going through my entire deleted items folder. Why is that? Shouldn't it just do items for today? I used the following command. Did I use it correctly?

et-mailbox | Export-Mailbox –ContentKeywords "PSLF " –TargetMailbox Administrator –TargetFolder 'MyData' -startdate 02/09/14 –DeleteContent
LVL 35

Expert Comment

by:Joseph Daly
ID: 39848005
I'm on 2010 right now so I can't test but if I remember correctly it will process all the messages but only remove the matches.

I would try this on your mailbox let it run to completion and then see. If I remember it should only do the matches and not ge whole mailbox. I think this scared me when I did it too.

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

This article explains how to move an Exchange 2013/2016 mailbox database and logs to a different drive.
Organisation is organized in a pattern to flow the day to day business, every application and system is interdepended on each other and when very important “Exchange Server downtime” happened.
This video discusses moving either the default database or any database to a new volume.
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…

621 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question