Scenario
For whatever reason, management or enterprise security comes to you and says they need an email removed from all users who received it. No one knows who all received it. Luckily, your organization has an Exchange server that makes this easy to do and in a short time, depending on how specific your query below is.
Get-Mailbox and Search-Mailbox with -DeleteContent
You will use two commands to get a list of mailboxes and search the subject, body, or several other attributes for the string that uniquely identifies the email. You can use * as a wildcard before and after the text as seen in the example below. When using the wildcard, be cautious to be very specific and avoid strings that would cast too big of a net. For example, I would probably never use -SearchQuery ‘Body:”*a*”‘ as that would delete every email that contained the letter “a” in the body. If you believe the email has been forwarded or replied to and you are searching by Subject, adding the * wildcard before the string you are searching for in the Subject will help find emails even with multiple FW or RE strings prefixed.
Login to your mail server. Open a PowerShell session with administrator privileges.
Add-PSSnapin -Name Microsoft.Exchange.Management.PowerShell.E2010
Get-Mailbox -ResultSize Unlimited | Search-Mailbox -SearchQuery ‘Subject:”*Text that needs to be removed*”‘ -DeleteContent | Where-Object {$_.ResultItemsCount} > filename_to_save_results_into.txt
For a list of the attributes you can search, you can reference “Keyword Query Language (KQL) syntax reference“.
For example, just change -SearchQuery ‘Subject to -SearchQuery ‘Body.
Side Note
You can add this script to a .ps1 file and just edit it as you need it.
I write the results to a file to documented what was changed and who was impacted. If you don’t want to do this, simple leave off the “> filename_to_save_results_into.txt”.
If an email to be removed is open at the time this script is executed, it will disappear once closed. The open email is not a persistent object.
References
Microsoft; “Keyword Query Language (KQL) syntax reference”; https://msdn.microsoft.com/library/ee558911(v=office.15).aspx
Microsoft; “Search-Mailbox”; https://technet.microsoft.com/en-us/library/dd298173%28v=exchg.150%29.aspx
William Murray; “Exchange: Find and Remove Emails”; http://www.wamurray.com/2015/08/10/exchange-find-and-remove-emails/