Scenario

For whatever reason, management or enterprise security comes to you and says they need an email removed from all users who received it.  No one knows who all received it.  Luckily, your organization has an Exchange server that makes this easy to do and in a short time, depending on how specific your query below is.

Get-Mailbox and Search-Mailbox with -DeleteContent

You will use two commands to get a list of mailboxes and search the subject, body, or several other attributes for the string that uniquely identifies the email.  You can use * as a wildcard before and after the text as seen in the example below.  When using the wildcard, be cautious to be very specific and avoid strings that would cast too big of a net.  For example, I would probably never use -SearchQuery ‘Body:”*a*”‘ as that would delete every email that contained the letter “a” in the body.  If you believe the email has been forwarded or replied to and you are searching by Subject, adding the * wildcard before the string you are searching for in the Subject will help find emails even with multiple FW or RE strings prefixed.

Login to your mail server.  Open a PowerShell session with administrator privileges.

Add-PSSnapin -Name Microsoft.Exchange.Management.PowerShell.E2010

Get-Mailbox -ResultSize Unlimited | Search-Mailbox -SearchQuery ‘Subject:”*Text that needs to be removed*”‘ -DeleteContent | Where-Object {$_.ResultItemsCount} > filename_to_save_results_into.txt

For a list of the attributes you can search, you can reference “Keyword Query Language (KQL) syntax reference“.

For example, just change -SearchQuery ‘Subject to -SearchQuery ‘Body.

Side Note

You can add this script to a .ps1 file and just edit it as you need it.

I write the results to a file to documented what was changed and who was impacted. If you don’t want to do this, simple leave off the “> filename_to_save_results_into.txt”.

If an email to be removed is open at the time this script is executed, it will disappear once closed. The open email is not a persistent object.

References

Microsoft; “Keyword Query Language (KQL) syntax reference”; https://msdn.microsoft.com/library/ee558911(v=office.15).aspx

Microsoft; “Search-Mailbox”; https://technet.microsoft.com/en-us/library/dd298173%28v=exchg.150%29.aspx

William Murray; “Exchange: Find and Remove Emails”; http://www.wamurray.com/2015/08/10/exchange-find-and-remove-emails/