Exchange message recall

A user sends a mail to an internal exchange 2007 distribution group by accident. They try to recall the message, is there any way as admin I can find out how many people opened the mail and how many mails were successfully recalled?
LVL 6
Sid_FAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Will SzymkowskiSenior Solution ArchitectCommented:
Recall does not work as expected at its best. If you want to recall/remove the an email it is best to use the Export-Mailbox cmdlet in Exchange 2007 to remove the mail message from everyone's inbox.

Will.
0
Sid_FAuthor Commented:
Can you provide more detail regarding the export mailbox. I'm unclear how exporting a users mailbox can remove the mail thanks
0
Will SzymkowskiSenior Solution ArchitectCommented:
The command below is an example of how you can remove mail items from multiple mailboxes.
$DisGroup = Get-DistributionGroupMember -Identity <groupname>
ForEach ($Mailbox in $DisGroup) { 
Export-Mailbox -Identity -$Mailbox -PSTFolderPath "c:\pstfiles\exportmail.pst" -BadItemLimit 1000000 -ContentKeywords "CLICK HERE" -DeleteContent -Confirm:$false
}

Open in new window


Will.
0
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

David Paris VicenteSystems and Comunications  Administrator Commented:
The recall function is a feature from the client perspective, in this case from Outlook in conjuction with Exchange.

I think the best way is to try delete the message from all recipients, like Will said.

You should look this link to accomplish that.

Regards,

D
0
Sid_FAuthor Commented:
I would be running this command across potentially thousands of mailboxes so I need to be very clear on the exact command.

The command seems to refer to keywords. This could be dangerous is there a way to delete specific messages as in identify them by id or something similar? Thanks
0
David Paris VicenteSystems and Comunications  Administrator Commented:
You can use the Get-MessageTrackingLog.


As an example:
[PS] C:\>Get-MessageTrackingLog -Sender User19-DB01@TailSpinToys.com -Recipients User1-DB01@TailSpinToys.com -MessageSubject "Origins of Legislation" -Start "4/19/2011 4:43:30 PM" -End "4/19/2011 4:50:30 PM" -MessageID "1cd4eba2-d158-4ea1-81a7-4dbbc659bd13@LAB-E2K10CSHT01.TailSpinToys.com" |fl *
 
 
PSComputerName          : lab-e2k10csht01.tailspintoys.com
RunspaceId              : a241bdf5-c2c6-4c99-8e5a-b395faa5e67a
Timestamp               : 4/19/2011 4:45:30 PM
ClientIp                : fe80::89dc:2ad8:e3b:c03%13
ClientHostname          : LAB-E2k10CSHT01
ServerIp                : fe80::89dc:2ad8:e3b:c03%13
ServerHostname          : LAB-E2k10CSHT01
SourceContext           : 08CDCCED60881B31;2011-04-19T21:45:30.419Z;0
ConnectorId             : LAB-E2K10CSHT01\Default LAB-E2K10CSHT01
Source                  : SMTP
EventId                 : RECEIVE
InternalMessageId       : 270
MessageId               : <1cd4eba2-d158-4ea1-81a7-4dbbc659bd13@LAB-E2K10CSHT01.TailSpinToys.com>
Recipients              : {User1-DB01@TailSpinToys.com}
RecipientStatus         : {}
TotalBytes              : 4146
RecipientCount          : 1
RelatedRecipientAddress :
Reference               :
MessageSubject          : Origins of Legislation
Sender                  : User19-DB01@TailSpinToys.com
ReturnPath              : User19-DB01@TailSpinToys.com
MessageInfo             : 0aI: NTS:
MessageLatency          :
MessageLatencyType      : None
EventData               : {[FirstForestHop, LAB-E2K10CSHT01.TailSpinToys.com]}
 
PSComputerName          : lab-e2k10csht01.tailspintoys.com
RunspaceId              : a241bdf5-c2c6-4c99-8e5a-b395faa5e67a
Timestamp               : 4/19/2011 4:45:30 PM
ClientIp                :
ClientHostname          : LAB-E2k10CSHT01
ServerIp                :
ServerHostname          : LAB-E2K10MBX02
SourceContext           : 08CDCCED60881B32;2011-04-19T21:45:30.575Z;0
ConnectorId             :
Source                  : STOREDRIVER
EventId                 : DELIVER
InternalMessageId       : 270
MessageId               : <1cd4eba2-d158-4ea1-81a7-4dbbc659bd13@LAB-E2K10CSHT01.TailSpinToys.com>
Recipients              : {User1-DB01@TailSpinToys.com}
RecipientStatus         : {}
TotalBytes              : 4318
RecipientCount          : 1
RelatedRecipientAddress :
Reference               :
MessageSubject          : Origins of Legislation
Sender                  : User19-DB01@TailSpinToys.com
ReturnPath              : User19-DB01@TailSpinToys.com
MessageInfo             : 2011-04-19T21:45:30.450Z;SRV=LAB-E2K10CSHT01.TailSpinToys.com:TOTAL=0
MessageLatency          : 00:00:00.2970000
MessageLatencyType      : EndToEnd
EventData               : {[MailboxDatabaseName, e2k10db01]}
0
Sid_FAuthor Commented:
Message tracking isn't going to tell me who opened the mail or how many mails were successfully recalled though or will it?
0
Will SzymkowskiSenior Solution ArchitectCommented:
There are different values you can use in place of -ContentKeywords. They are below...
- SenderKeyWords
- SubjectKeywords
- RecipientKeyWords

You can also use -Start -End parameters as well to isolate the message during a period of time.

Another thing i would recommend is just running this against a single mailbox as well to ensure that the correct message gets removed. All of the messages will be stored in the PST file, so if an email does get inadvertently removed you will be able to recover it from the PST.

The below command is for a single mailbox.
Export-MailBox -Identity User1 -PSTFolderPath "c:\pstfiles\exportmail.pst" -BadItemLimit 1000000 -SubjectKeyWords "CLICK HERE" -DeleteContent -Confirm:$false

Open in new window


Once you have confirmed that the single script works and removes the correct email apply it to the first script i posted.

Will.
0
Sid_FAuthor Commented:
Thanks am I correct in saying one pst will be created and all the deleted emails from all the mailboxes will be moved to this pst?

I have multiple exchange stores I presume the command needs to be run against each one?
0
Sid_FAuthor Commented:
I'm thinking if there are only Sender subject and recipient keywords this could potentially delete a lot more messages that just the required message as the criteria is very wide
0
Will SzymkowskiSenior Solution ArchitectCommented:
Thanks am I correct in saying one pst will be created and all the deleted emails from all the mailboxes will be moved to this pst?

The above is correct. 1 PST for all items.

I'm thinking if there are only Sender subject and recipient keywords this could potentially delete a lot more messages that just the required message as the criteria is very wide

As I have stated in my last post, you can also use -Start and -End parameters to define a smaller range of time.

I have multiple exchange stores I presume the command needs to be run against each one?
The second script i provided is for testing against a single mailbox. The first script i provided will run against the Distribution Group the original sender sent to on Each Users mailbox that is in the Distribution Group specified.  

Will.
0
Sid_FAuthor Commented:
I get an error when I run the command

You are running on a 64-bit computer. To export to or import from a .pst file,
you must be running a 32-bit computer that has Outlook 2003 SP2 or later instal
led.
At line:1 char:1
+  <<<< export-MailBox -Identity test1 -PSTFolderPath "c:\pstfiles\exportmail.
pst" -BadItemLimit 1000000 -SubjectKeyWords "maserati" -DeleteContent -Confirm:
$false
    + CategoryInfo          : InvalidOperation: (:) [], RecipientTaskException
    + FullyQualifiedErrorId : 43AA0383
0
Will SzymkowskiSenior Solution ArchitectCommented:
You are running on a 64-bit computer. To export to or import from a .pst file,
 you must be running a 32-bit computer that has Outlook 2003 SP2 or later instal

In Exchange 2007 you need to use a server or client that is 32bit only. You cannot use a 64bit machine to perform the export. Which means you cannot do this export directly from the server because the server is 64bit.

Will.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Sid_FAuthor Commented:
Thanks apologies for delay
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.