Friday, September 11, 2015

Delete a spam or specific Message from all mailboxes on Exchange 2010

The following two method that you can use to delete a spam or specific message from all Mailbox on your exchange server 2010:

Method #1:
Run the following PSCMD for each exchange server that you have, to delete the message with the following criteria (Subject / From | Received / Date).

Get-Mailbox -Database “mailbox server” | Search-Mailbox  -targetmailbox backupmailbox -targetfolder “DeletedMSG” -SearchQuery {Subject:"the subject of the target message" AND From:"Sender email address" AND Sent:"02/12/2014 12:45:00"} -loglevel full -DeleteContent

Method #2:
Run the following two small PS scripts to track and delete the messages.


Tracking:
-----------------
$x = Get-ExchangeServer | where {$_.isHubTransportServer -eq $true -or $_.isMailboxServer -eq $true} | Get-MessageTrackingLog  -messagesubject "security"  -eventid “deliver” -Start "02/12/2014 12:45:00 PM" -end "02/12/2014 12:47:00 PM" -resultsize "unlimited"
$y = $x|select timestamp, sender, @{l="Recipients";e={$_.Recipients -join " "}}, messagesubject, serverhostname, messageid |Sort-Object -Property timestamp
$y|export-csv c:\temp\tracking.csv

Deletion :
------------
$x=get-content c:\OrderInvoice.txt
foreach ($y in $x)
{
$result=$null
$count=$null
$result=Search-Mailbox -identity $y -SearchQuery 'subject:"OrderInvoice" AND Received:23/11/2014' -DeleteContent -force -resultsize unlimited
$count=$result.ResultItemsCount
add-content C:\result.txt "$count`n"
}