Exchange message recall

A user sends a mail to an internal exchange 2007 distribution group by accident. They try to recall the message, is there any way as admin I can find out how many people opened the mail and how many mails were successfully recalled?
LVL 6
Sid_FAsked:
Who is Participating?
 
Will SzymkowskiSenior Solution ArchitectCommented:
You are running on a 64-bit computer. To export to or import from a .pst file,
 you must be running a 32-bit computer that has Outlook 2003 SP2 or later instal

In Exchange 2007 you need to use a server or client that is 32bit only. You cannot use a 64bit machine to perform the export. Which means you cannot do this export directly from the server because the server is 64bit.

Will.
0
 
Will SzymkowskiSenior Solution ArchitectCommented:
Recall does not work as expected at its best. If you want to recall/remove the an email it is best to use the Export-Mailbox cmdlet in Exchange 2007 to remove the mail message from everyone's inbox.

Will.
0
 
Sid_FAuthor Commented:
Can you provide more detail regarding the export mailbox. I'm unclear how exporting a users mailbox can remove the mail thanks
0
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

 
Will SzymkowskiSenior Solution ArchitectCommented:
The command below is an example of how you can remove mail items from multiple mailboxes.
$DisGroup = Get-DistributionGroupMember -Identity <groupname>
ForEach ($Mailbox in $DisGroup) { 
Export-Mailbox -Identity -$Mailbox -PSTFolderPath "c:\pstfiles\exportmail.pst" -BadItemLimit 1000000 -ContentKeywords "CLICK HERE" -DeleteContent -Confirm:$false
}

Open in new window


Will.
0
 
David Paris VicenteSystems and Comunications  Administrator Commented:
The recall function is a feature from the client perspective, in this case from Outlook in conjuction with Exchange.

I think the best way is to try delete the message from all recipients, like Will said.

You should look this link to accomplish that.

Regards,

D
0
 
Sid_FAuthor Commented:
I would be running this command across potentially thousands of mailboxes so I need to be very clear on the exact command.

The command seems to refer to keywords. This could be dangerous is there a way to delete specific messages as in identify them by id or something similar? Thanks
0
 
David Paris VicenteSystems and Comunications  Administrator Commented:
You can use the Get-MessageTrackingLog.


As an example:
[PS] C:\>Get-MessageTrackingLog -Sender User19-DB01@TailSpinToys.com -Recipients User1-DB01@TailSpinToys.com -MessageSubject "Origins of Legislation" -Start "4/19/2011 4:43:30 PM" -End "4/19/2011 4:50:30 PM" -MessageID "1cd4eba2-d158-4ea1-81a7-4dbbc659bd13@LAB-E2K10CSHT01.TailSpinToys.com" |fl *
 
 
PSComputerName          : lab-e2k10csht01.tailspintoys.com
RunspaceId              : a241bdf5-c2c6-4c99-8e5a-b395faa5e67a
Timestamp               : 4/19/2011 4:45:30 PM
ClientIp                : fe80::89dc:2ad8:e3b:c03%13
ClientHostname          : LAB-E2k10CSHT01
ServerIp                : fe80::89dc:2ad8:e3b:c03%13
ServerHostname          : LAB-E2k10CSHT01
SourceContext           : 08CDCCED60881B31;2011-04-19T21:45:30.419Z;0
ConnectorId             : LAB-E2K10CSHT01\Default LAB-E2K10CSHT01
Source                  : SMTP
EventId                 : RECEIVE
InternalMessageId       : 270
MessageId               : <1cd4eba2-d158-4ea1-81a7-4dbbc659bd13@LAB-E2K10CSHT01.TailSpinToys.com>
Recipients              : {User1-DB01@TailSpinToys.com}
RecipientStatus         : {}
TotalBytes              : 4146
RecipientCount          : 1
RelatedRecipientAddress :
Reference               :
MessageSubject          : Origins of Legislation
Sender                  : User19-DB01@TailSpinToys.com
ReturnPath              : User19-DB01@TailSpinToys.com
MessageInfo             : 0aI: NTS:
MessageLatency          :
MessageLatencyType      : None
EventData               : {[FirstForestHop, LAB-E2K10CSHT01.TailSpinToys.com]}
 
PSComputerName          : lab-e2k10csht01.tailspintoys.com
RunspaceId              : a241bdf5-c2c6-4c99-8e5a-b395faa5e67a
Timestamp               : 4/19/2011 4:45:30 PM
ClientIp                :
ClientHostname          : LAB-E2k10CSHT01
ServerIp                :
ServerHostname          : LAB-E2K10MBX02
SourceContext           : 08CDCCED60881B32;2011-04-19T21:45:30.575Z;0
ConnectorId             :
Source                  : STOREDRIVER
EventId                 : DELIVER
InternalMessageId       : 270
MessageId               : <1cd4eba2-d158-4ea1-81a7-4dbbc659bd13@LAB-E2K10CSHT01.TailSpinToys.com>
Recipients              : {User1-DB01@TailSpinToys.com}
RecipientStatus         : {}
TotalBytes              : 4318
RecipientCount          : 1
RelatedRecipientAddress :
Reference               :
MessageSubject          : Origins of Legislation
Sender                  : User19-DB01@TailSpinToys.com
ReturnPath              : User19-DB01@TailSpinToys.com
MessageInfo             : 2011-04-19T21:45:30.450Z;SRV=LAB-E2K10CSHT01.TailSpinToys.com:TOTAL=0
MessageLatency          : 00:00:00.2970000
MessageLatencyType      : EndToEnd
EventData               : {[MailboxDatabaseName, e2k10db01]}
0
 
Sid_FAuthor Commented:
Message tracking isn't going to tell me who opened the mail or how many mails were successfully recalled though or will it?
0
 
Will SzymkowskiSenior Solution ArchitectCommented:
There are different values you can use in place of -ContentKeywords. They are below...
- SenderKeyWords
- SubjectKeywords
- RecipientKeyWords

You can also use -Start -End parameters as well to isolate the message during a period of time.

Another thing i would recommend is just running this against a single mailbox as well to ensure that the correct message gets removed. All of the messages will be stored in the PST file, so if an email does get inadvertently removed you will be able to recover it from the PST.

The below command is for a single mailbox.
Export-MailBox -Identity User1 -PSTFolderPath "c:\pstfiles\exportmail.pst" -BadItemLimit 1000000 -SubjectKeyWords "CLICK HERE" -DeleteContent -Confirm:$false

Open in new window


Once you have confirmed that the single script works and removes the correct email apply it to the first script i posted.

Will.
0
 
Sid_FAuthor Commented:
Thanks am I correct in saying one pst will be created and all the deleted emails from all the mailboxes will be moved to this pst?

I have multiple exchange stores I presume the command needs to be run against each one?
0
 
Sid_FAuthor Commented:
I'm thinking if there are only Sender subject and recipient keywords this could potentially delete a lot more messages that just the required message as the criteria is very wide
0
 
Will SzymkowskiSenior Solution ArchitectCommented:
Thanks am I correct in saying one pst will be created and all the deleted emails from all the mailboxes will be moved to this pst?

The above is correct. 1 PST for all items.

I'm thinking if there are only Sender subject and recipient keywords this could potentially delete a lot more messages that just the required message as the criteria is very wide

As I have stated in my last post, you can also use -Start and -End parameters to define a smaller range of time.

I have multiple exchange stores I presume the command needs to be run against each one?
The second script i provided is for testing against a single mailbox. The first script i provided will run against the Distribution Group the original sender sent to on Each Users mailbox that is in the Distribution Group specified.  

Will.
0
 
Sid_FAuthor Commented:
I get an error when I run the command

You are running on a 64-bit computer. To export to or import from a .pst file,
you must be running a 32-bit computer that has Outlook 2003 SP2 or later instal
led.
At line:1 char:1
+  <<<< export-MailBox -Identity test1 -PSTFolderPath "c:\pstfiles\exportmail.
pst" -BadItemLimit 1000000 -SubjectKeyWords "maserati" -DeleteContent -Confirm:
$false
    + CategoryInfo          : InvalidOperation: (:) [], RecipientTaskException
    + FullyQualifiedErrorId : 43AA0383
0
 
Sid_FAuthor Commented:
Thanks apologies for delay
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.