Home > Exchange 2010 > Removing specific messages from your Exchange Server 2010

Removing specific messages from your Exchange Server 2010

In this article we will go through simple ways and steps for how to removing specific messages from your Exchange Server 2010.

In the business need you may face this case “someone have a permission to send message to all the organization, sent message by mistake to all and we need to know whom received this message and completely remove it from their mailboxes”

In fact we can perform this request by different ways:

  1. You can create transport rule to delete this message in Exchange 2010.
  2. Assigns the Full Access mailbox permission to the MyAdmin account and remove this message manually.
  3. Using EMS “Exchange Management Shell” to know who received this message and remove it from their mailboxes.

First and second ways not recommended for many reasons in addition to the need to know whom received this message as you can not get this info by this ways.

So we will talk about third one.

Prerequisites:

Make sure the account running the PS command has the appropriate permissions; you need to specifically have access to the New-MailboxImportRequest cmdlet. If you don’t have the correct permissions you will get an error “The term ‘New-MailboxImportRequest’ is not recognized as the name of a cmdlet”.

To add the permission run the following command:

New-ManagementRoleAssignment -Name “Import Export Mailbox Admins” -user “User Account” -Role “Mailbox Import Export”

Change User Account in the above cmdlet to the actual username

Using EMS “Exchange Management Shell” to know who received this message and remove it from their mailboxes.

{First}  If you just need to know who is received the message you can use the following command:

Get-Mailbox -Server ServerName -ResultSize unlimited | Search-Mailbox -Targetfolder “deleted items” -Targetmailbox “Mybackupmailbox” -SearchQuery ‘Received:11/24/2013 AND Subject:”Type Subject Here”‘ -loglevel full

Note: the result of this search will be send to the target mailboxMybackupmailbox” and you can determine mailbox for this reason or you can use your mailbox if you is the administrator and you will get a copy of this message under the target folderdeleted items” and also you can change it to be Inbox for example, also preferred to determine the date of this message that you look-up for, using the subject to determine the message subject and using Loglevel full to get attachment with the result details.

Capture

In the previous screen the ResultItemsCount refer to the number of the message founded in this user mailbox and the ResultItemsSize refer to the message size.

 {Second} To remove the message from mailbox server level use the following command:

Get-Mailbox -Server ServerName -ResultSize unlimited | Search-Mailbox -targetfolder “deleted items” -targetmailbox “Mybackupmailbox” -SearchQuery ‘Received:11/24/2013 AND Subject:”Type Subject Here”‘ -loglevel full -DeleteContent -force

Note: Also you can run this command on the Database mailbox level and user level.

 

Capture2

In the previous screen you can find the search result with the attached result, the message size and items number that refer to my search matched with three mailboxes only or repeated on the same mailbox.

Capture3

In the previous screen you can find the copy of message under the deleted items.

😀

Advertisements
  1. July 15, 2014 at 3:02 pm

    For using in specific user mail box use the following Command:

    Get-Mailbox SourceUserMailBox -ResultSize unlimited | Search-Mailbox -targetfolder “deleted items” -targetmailbox “TargetUserMailbox” -SearchQuery`Received:7/15/2014 AND Subject:”Subject of the message”` -loglevel full-DeleteContent -force

  1. No trackbacks yet.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: