Well, I can't remember everything...

Wednesday, 3 June 2015

Deleting a Specific Email from all Exchange Mailboxes Using Powershell (eg. Spam, Phishing, Virus)

If your organisation receives a dodgy email, or someone within your organisation forwards one, here is a PS one-liner to delete it from all mailboxes in Exchange 2010

Get-Mailbox -ResultSize Unlimited | Search-Mailbox -SearchQuery 'Subject:"*Anlieferung Ihrer  Sendung 35171196631*"' -DeleteContent | Where-Object {$_.ResultItemsCount}

Obviously you will need to make sure your search term only targets that specific email. Luckily in the case above, it is a very unique email subject!

It is also recommended to type this command out manually, rather than copying from the page. Single and double quotes can get lost in the translation!

You can preview how many messages will be deleted by replacing -DeleteContent with -EstimateResultOnly

The more mailboxes and emails you have, the longer this will take to complete.

This does not search any PST files a user has, just their Exchange mailbox