Applies to: Exchange Server 2010 SP3, Exchange Server 2010 SP2

Topic Last Modified: 2012-07-23

In Exchange 2010 Service Pack 1 (SP1), you can use the Search-Mailbox cmdlet to search for and delete messages from a mailbox.

To search for and delete messages in one step, run the Search-Mailbox cmdlet with the DeleteContent switch. However, when you do this, you can't preview search results or generate a log of messages that will be returned by the search. To preview a log of the messages found in the search before they're deleted, you can run the Search-Mailbox cmdlet with the LogOnly switch.

As an additional safeguard, you can first copy the messages to another mailbox by using the TargetMailbox and TargetFolder parameters. By doing this, you retain a copy of the deleted messages in case you need to access them again.

Looking for other management tasks related to discovery? Check out Managing Discovery.

Prerequisites

  • If the mailbox from which you want to delete messages has single item recovery enabled, you must first disable the feature. For details, see Enable Single Item Recovery for a Mailbox.

  • If the mailbox from which you want to delete messages is placed on litigation hold, we recommend that you check with your records management or legal department before removing the hold and deleting the mailbox content. After you obtain approval, follow the steps listed in the topic Clean Up the Recoverable Items Folder.

Use the Shell to search for messages and log the search results

You need to be assigned permissions before you can perform this procedure. To see what permissions you need, see the "Delete mailbox content" entry in the Messaging Policy and Compliance Permissions topic.

Note:
You can't use the Exchange Management Console (EMC) to search for messages and log search results.

This example searches April Stewart's mailbox for messages that contain the phrase "Your bank statement" in the Subject field and logs the search results in the SearchAndDeleteLog folder of the administrator's mailbox. Messages aren't copied to or deleted from the target mailbox.

Note:
The LogOnly parameter is available only in Exchange 2010 SP1.
Copy Code 
Search-Mailbox -Identity "April Stewart" -SearchQuery "Subject:'Your bank statement'" -TargetMailbox "administrator" -TargetFolder "SearchAndDeleteLog" -LogOnly -LogLevel Full

For detailed syntax and parameter information, see Search-Mailbox.

Use the Shell to search for and delete messages

You need to be assigned permissions before you can perform this procedure. To see what permissions you need, see the "Delete mailbox content" entry in the Messaging Policy and Compliance Permissions topic.

Note:
You can't use the Exchange Management Console (EMC) to search for and delete messages.

This example searches April Stewart's mailbox for messages that contain the phrase "Your bank statement" in the Subject field and deletes the messages from the source mailbox without copying the search results to another folder.

Important:
When you use the Search-Mailbox cmdlet with the DeleteContent switch, messages are permanently deleted from the source mailbox. Before you permanently delete messages, we recommend that you either use the LogOnly switch to generate a log of the messages found in the search before they're deleted or copy the messages to another mailbox before deleting them from the source mailbox.
Copy Code 
Search-Mailbox -Identity "April Stewart" -SearchQuery "Subject:'Your bank statement'" -DeleteContent

This example searches April Stewart's mailbox for messages that contain the phrase "Your bank statement" in the Subject field, copies the search results to the folder AprilStewart-DeletedMessages in the mailbox BackupMailbox, and deletes the messages from April's mailbox.

Copy Code 
Search-Mailbox -Identity "April Stewart" -SearchQuery "Subject:'Your bank statement'" -TargetMailbox "BackupMailbox" -TargetFolder "AprilStewart-DeletedMessages" -LogLevel Full -DeleteContent

For detailed syntax and parameter information, see Search-Mailbox.