How to delete email from mailboxes on Exchange 2016 / 2013 / 2010 / Online

Applies to: Exchange 2016, Exchange 2013, Exchange 2010, Exchange Online

In this article I am going to show you how to use the Search-Mailbox PowerShell cmdlet together with the -DeleteContent switch to delete email (and other item types) from multiple mailboxes on Microsoft Exchange 2016, 2013 and 2010.

PowerShell: using the Search-Mailbox command to delete items

I will also talk about using the -SearchQuery parameter to manage items scopes and target specific content.

Contents

Required permissions

The minimum required permissions to be able to perform searches and deletions are:

You can assign them via Exchange admin center, Permissions, admin roles (Exchange 2010: ECP, Roles & Auditing, Administrator Roles).

  • Mailbox Search is by default part of the Discovery Management role.
  • Mailbox Import Export is not part of any of the default role groups, so you have to either add it to e.g. Discovery Management or create a custom role group for Mailbox Search and Mailbox Import Export.

To assign the roles directly to a user via PowerShell, run:

New-ManagementRoleAssignment -Role "Mailbox Import Export" -User "<user name or alias>"

New-ManagementRoleAssignment -Role "Mailbox Search" -User "<user name or alias>"

Learn more about Role Based Access Control

Learn how to connect to Office 365 remotely using PowerShell

Searching and deleting content from one mailbox

Before we discuss deleting items from multiple mailboxes, lets take a look at a very basic Search-Mailbox command that lets you delete all content from a single mailbox:

Search-Mailbox -Identity "<User's Name, Alias, DN, GUID, SMTP email or UPN>" -DeleteContent

Tip 1: To skip the confirmation prompt use the -Force switch.

Tip 2: To check how much data you will be deleting, first run the Search-Mailbox command with the -EstimateResultsOnly switch first (you can have the same information sent to a selected mailbox using the -LogOnly switch, but keep in mind that it requires you to provide a target mailbox and folder).

Limiting the scope of deleted items

You can limit the scope of the search & delete process using these parameters:

-SearchQuery

In Exchange 2010, 2013 and 2016 the range of queryable item properties and operations you can perform on them is quite wide.

You can use all properties listed in this article and the operations you can perform on them come courtesy of KQL (Keyword Query Language). Specific examples of queries in section below.

Note: Exchange 2010 uses a query language, which is slightly less agile. Learn more in this TechNet article.

-SearchDumpster

By default the Recoverable items folder of a mailbox is searched. To exclude it add -SearchDumpster:$false to your script.

-DoNotIncludeArchive

Excludes the archive of a given mailbox (switch).

-SearchDumpsterOnly

Limits the search and deletion to the Recoverable items folder of a given mailbox (switch).

Examples of condition queries

The section below contains excerpts of scripts targeting types of items that I think will be most useful. If you would like to see an addition to this list, please let me know in the comments.

Deleting emails with #keyword# in the subject received from someone outside of your domain

Search-Mailbox ... -SearchQuery 'subject:#keyword# AND from<>#Your domain#' -DeleteContent

Deleting emails and calendar events received prior to a specified date

Search-Mailbox ... -SearchQuery '(kind:email OR kind:meetings) AND received<#Date in MM/dd/yyyy format#' -DeleteContent

Deleting emails with total size of attachments over #number# bytes

Search-Mailbox ... -SearchQuery 'hasattachment:true AND size>#number#' -DeleteContent

IMPORTANT: Since the size attribute only checks the size of the entire message, this query may target a slightly larger scope of items with attachments than just the ones with total size of attachments exceeding #number#.

List of properties you can query using Search-Mailbox

Deleting emails from multiple mailboxes

To extend the search and delete process to multiple mailboxes you can use PowerShell’s pipeline or foreach loop mechanism.

For example, the below commands delete content that matches #Your query# from all mailboxes that can be found in an organization:

Get-Mailbox | Search-Mailbox -SearchQuery '#Your query#' -DeleteContent

foreach ($mailbox in (get-mailbox)) {Search-Mailbox -id $mailbox -SearchQuery '#Your query#' -DeleteContent -Force}

NOTE: When using the foreach method, I recommend appending the command with a -Force switch. Otherwise you will have to confirm the content deletion for each individual mailbox.

The result of the two above commands is identical in terms of deleted content.

If you add a target mailbox and folder to the command (see Additional switches and parameters below), the Get-Mailbox pipeline will generate 1 search summary and log file, while the foreach loop will generate separate search summaries and log files for each mailbox.

Both methods allow for limiting the scope of mailboxes on which the search and delete operation is performed.

The Get-Mailbox pipeline also lets you perform simple scoping operations, such as limiting the output to a defined mailbox database, organizational unity, domain, or mailboxes of a certain type. For further details see this TechNet article.

Additional switches and parameters

After you run the Search-Mailbox command with the -DeleteContent switch, the output is going to contain a very basic summary of the process (example in below image).

PowerShell: Example output of Search-Mailbox command

-EstimateResultsOnly

As I mentioned earlier, you can use this switch to get the above type of summary, before using the -DeleteContent switch. Note that -EstimateResultsOnly cannot be used together with -DeleteContent. Example:

Search-Mailbox ... -SearchQuery '#Your query#' -EstimateResultsOnly

-LogOnly

By default the -LogOnly switch sends the exact same basic information as -EstimateResultsOnly to a specified mailbox. This is because the default log level is ‘Basic’. You can change this by raising the log level to full.

Note that, when using the -LogOnly switch, you have to define the target mailbox and folder and you cannot use the -DeleteContent switch. Example:

Search-Mailbox ... -SearchQuery '#Your query#' -LogOnly -LogLevel:full -TargetMailbox #Mailbox id# -TargetFolder #Folder name#

-LogLevel

You can also use the -LogLevel parameter together with the -DeleteContent switch to obtain detailed information about what has been deleted. Like above, you will have to raise the log level to full and specify a target mailbox and folder.

After the search and delete process succeeds, in the specified location you will find an email with a zipped CSV file attached containing a list of deleted items.

Search-Mailbox ... -SearchQuery '#Your query#' -DeleteContent -LogLevel:full -TargetMailbox #Mailbox id# -TargetFolder #Folder name#

Suggested tools

CodeTwo Backup for Exchange: Brick-level backups of Exchange mailboxes

CodeTwo Backup for Office 365: Offline backup copies of Office 365 data

How to delete email from mailboxes on Exchange 2016 / 2013 / 2010 / Online by

3 thoughts on “How to delete email from mailboxes on Exchange 2016 / 2013 / 2010 / Online


  1. Hi Adam
    Firs method not working for me.

    but anyway we found solution,
    get-mailbox -resultsize unlimited | search-mailbox -SearchQuery ‘subject:”ტესტი”‘–DeleteContent
    it ”ტესტი” will appear as ?????? i exchange console but it swill works!
    Thanks for support!

  2. we are using this command to delete messages tought subject:
    get-mailbox -resultsize unlimited | search-mailbox -SearchQuery ‘subject:”free sex”‘–DeleteContent -Force

    but unfortunately we didn’t know how to delete message if subject is whitened in Unicode for example if subject is “ტესტ” this word is not recognized exchange command line :(
    please help how to solve this problem

    • Hi Mitxujan,

      Please try applying this solution: http://silentcrash.com/2012/05/how-to-add-hebrew-to-powershell-or-command-cmd-console/ and then simply running:

      ... Search-Mailbox -SearchQuery 'subject:' ...

      Other methods you could try is importing the subject into a variable from a Unicode file, e.g.:

      $subject = Get-Content

      or getting it from message tracking logs:

      $subject = (Get-MessageTrackingLog -MessageID b3ef49986e16424fa0f6a6181aaa71cc@dstdomain2.lan | Select -First 1).MessageSubject

      And then running:

      ... Search-Mailbox -SearchQuery 'subject:$subject' ...

      Let me know if this helps,
      Adam

Leave a Reply

Your email address will not be published.

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

*

*