Generate a list of emails in Exchange 2013 deleted more than 90 days agao

I need to view deleted items for a large number of users and possibly remove items deleted more than 90 days ago.   The server in question is an onsite Exchange 2013 server running on  Windows 2008r2.  I was hoping to generate a report for all users and just list any deleted items > 90 days but have been unable to do so.   I did try the get-recoverableitems command but it is unrecognized on the server.

Is their another way to get this information?
qvfpsAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

timgreen7077Exchange EngineerCommented:
The problem with that is logs are kept for 30 days by default, and actual deleted mail items are kept for 14 days by default, do if all the default options are used then there is no way to retrieve that information. You will need to review the retention policies on the mailbox DBs and see how long mail is retained after being deleted but by default it's 14 days, and the logs which doesn't show anything about deleted items are 30 days by default. Possible you may be out of luck on that request.
David FavorLinux/LXD/WordPress/Hosting SavantCommented:
Maybe what you're taking about is just running the IMAP EXPUNGE operation, which physically removes deleted files.

To do this, you'll just write some simple code to connect to your IMAP server using some sort of system admin privilege, walk through all accounts + all folders + issue an EXPUNGE.

Some mail servers allow a non-standard recursive EXPUNGE in all folders for a given user.

You'll have to dig into the depths of full IMAP syntax Exchange supports.

Note: Exchange docs contain long discussions about setting retention policy. There is no message of how to set any type of EXPUNGE policy.
qvfpsAuthor Commented:
The original mail policy was to never remove items from deleted items.  Lots of users deleted mail from their mailbox but never removed it from Deleted items.  They have recently requested a change to the policy but want to see how much is actually out there and a way to verify that the new policy is working.
Ensure Business Longevity with As-A-Service

Using the as-a-service approach for your business model allows you to grow your revenue stream with new practice areas, without forcing you to part ways with existing clients just because they don’t fit the mold of your new service offerings.

timgreen7077Exchange EngineerCommented:
If you want to just get a count of what's in the user's deleted items folder you can run the following:

Get-Mailbox -ResultSize unlimited | Get-MailboxFolderStatistics -FolderScope DeletedItems | select identity, FolderAndSubfolderSize, ItemsInFolder | Export-Csv c:\temp\results.csv -NoTypeInformation

This will give you every mailbox and just the items that are currently in the deleted items folder. There is no way to show what was deleted from that specific folder based on a date range.
qvfpsAuthor Commented:
Thanks for the suggestion but I have already used Get-MailboxFolderStatistics to generate a report for all mailboxes showing the size of each folder but that wasn't what they were looking for.   I need to list deleted items by user by date if possible.
timgreen7077Exchange EngineerCommented:
Not possible.
David FavorLinux/LXD/WordPress/Hosting SavantCommented:
The IMAP protocol provides 2x separate operations, which can be confusing.

1) Delete message - this just adds a flag to the message file.

url="https://wiki2.dovecot.org/MailboxFormat/Maildir"]https://wiki2.dovecot.org/MailboxFormat/Maildir[/url] describes the Dovecot flags. These flags vary wildly between IMAP servers. Some IMAP code uses an entirely different scheme.

Deletion can also include moving a message to a Deleted folder.

Note: Even if you delete messages from the Deleted folder or any other folder, messages still exist.

2) Expunge folder - Actually issue a file system primitive operation, like unlink(file) in Linux.

So... Delete != Expunge...

To actually remove messages from physical media + return disk space to OS, requires an expunge.

Per above, I don't see any note in the Exchange Docs about providing any type of actual expunge policy.

This suggests, each user must actually run a full expunge themselves.

In Thunderbird, an expunge fires when a user selects the action Compact Folders.

Point: You may have to write some IMAP code to do actual expunges or if Exchange manages files with flags, where you can test for deleted files older than some time period, then you can just remove these.

This implies Exchange stores messages like this + you have access to these files + removing them at the OS level won't crash Exchange.

With Dovecot, you can just remove messages anytime out of the backing store (filesystem) + all will be well.

Exchange might be the same.

You might test just removing files (if possible) + see if Exchange survives. If it does, then fairly simple to do a nightly remove of all messages which are marked as deleted.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.