Applies to: Exchange Server 2010 SP2
Topic Last Modified: 2013-02-26
You can use the Search-Mailbox cmdlet to search and delete messages from a mailbox.
To search and delete messages in one step, run the Search-Mailbox cmdlet with the DeleteContent switch. However, when you do this, you can't preview search results or generate a log of messages that will be returned by the search, and you may inadvertently delete messages that you didn't intend to. To preview a log of the messages found in the search before they're deleted, run the Search-Mailbox cmdlet with the LogOnly switch.
As an additional safeguard, you can first copy the messages to another mailbox by using the TargetMailbox and TargetFolder parameters. By doing this, you retain a copy of the deleted messages in case you need to access them again.
For additional management tasks related to In-Place eDiscovery, see In-Place eDiscovery Procedures.
What do I need to know before I begin?
- Estimated time to complete: 10 minutes. The actual time may
vary depending on the size of the mailbox and the search query.
- You need to be assigned permissions before you can perform this
procedure or procedures. To see what permissions you need, see the
"Delete mailbox content" entry in the Messaging Policy and
Compliance Permissions topic.
- If the mailbox from which you want to delete messages has
single item recovery enabled, you must first disable the
feature.
- If the mailbox from which you want to delete messages is placed
on litigation hold, we recommend that you check with your records
management or legal department before removing the hold and
deleting the mailbox content. After you obtain approval, follow the
steps listed in the topic Clean Up the Recoverable
Items Folder.
- You can't use the Exchange admin center (EAC) to perform these
procedures. You must use the Shell.
What do you want to do?
Search messages and log the search results
This example searches April Stewart's mailbox for messages that contain the phrase "Your bank statement" in the Subject field and logs the search results in the SearchAndDeleteLog folder of the administrator's mailbox. Messages aren't copied to or deleted from the target mailbox.
 Copy Code |
|
|---|---|
Search-Mailbox -Identity "April Stewart" -SearchQuery "Subject:'Your bank statement'" -TargetMailbox "administrator" -TargetFolder "SearchAndDeleteLog" -LogOnly -LogLevel Full |
|
For detailed syntax and parameter information, see Search-Mailbox.
Search and delete messages
This example searches April Stewart's mailbox for messages that contain the phrase "Your bank statement" in the Subject field and deletes the messages from the source mailbox without copying the search results to another folder.
 Caution: |
|---|
| When you use the Search-Mailbox cmdlet with the DeleteContent switch, messages are permanently deleted from the source mailbox. Before you permanently delete messages, we recommend that you either use the LogOnly switch to generate a log of the messages found in the search before they're deleted or copy the messages to another mailbox before deleting them from the source mailbox. |
| Copy Code |
|
|---|---|
Search-Mailbox -Identity "April Stewart" -SearchQuery "Subject:'Your bank statement'" -DeleteContent |
|
This example searches April Stewart's mailbox for messages that contain the phrase "Your bank statement" in the Subject field, copies the search results to the folder AprilStewart-DeletedMessages in the mailbox BackupMailbox, and deletes the messages from April's mailbox.
| Copy Code |
|
|---|---|
Search-Mailbox -Identity "April Stewart" -SearchQuery "Subject:'Your bank statement'" -TargetMailbox "BackupMailbox" -TargetFolder "AprilStewart-DeletedMessages" -LogLevel Full -DeleteContent |
|
For detailed syntax and parameter information, see Search-Mailbox.