You could try something like this: Search-Mailbox -SearchQuery '"I have been informed" AND subject:"You are a winner!" AND from:"[email protected]" AND sent:"08/13/2015"'
Please note that I do not have an Exchange 2010 system on which to test that search before I sent this reply, but I am pretty sure it would work. That search should find any message from [email protected] that was sent on August 13, 2015, with subject "You are a winner!", and which contains the string "I have been informed" somewhere in the message. Try a search like that on a message that you know exists in your mailbox and see if it works. Dave From: [email protected] [mailto:[email protected]] On Behalf Of Todd Lemmiksoo Sent: Friday, August 21, 2015 14:02 To: [email protected] Subject: Re: [Exchange] Powershell to remove email from mailboxes Since I have never used " Search Mailbox Search Query" before, the examples I found were for Subject or Body. How would I have included "sender". On Fri, Aug 21, 2015 at 11:03 AM, Beauvais, Dave <[email protected]<mailto:[email protected]>> wrote: Todd, Your search criteria was not specific enough, which is why you got more search results than you wanted or expected. You could have added additional criteria such as the sender, date sent, message ID, the exact subject line, and so on to narrow down the results to just the mailboxes containing that specific message. Especially when you are deleting matching content from a user's mailbox, you want to be as specific as possible. As an example of how a broad search query can return undesired results, I searched my own mailbox for "I have been informed" and found three messages from a few years ago. One included the sentence "I have been informed that the department wants to have three calendars instead of just one." With your search, that message would have been found and deleted. Dave Beauvais -- Dave W. Beauvais, Exchange and Office 365 Services Administrator Ohio University Office of Information Technology From: [email protected]<mailto:[email protected]> [mailto:[email protected]<mailto:[email protected]>] On Behalf Of Todd Lemmiksoo Sent: Friday, August 21, 2015 10:44 To: [email protected]<mailto:[email protected]> Subject: Re: [Exchange] Powershell to remove email from mailboxes The query does not return all 4600+ mailboxes, just a couple hunderd which is more that the 40 people that received the email in question. I put the 40 email addresses in a txt file and took that into my script to remove the questionable email. On Fri, Aug 21, 2015 at 6:05 AM, Gavin Wilby <[email protected]<mailto:[email protected]>> wrote: If I ran that query id expect all my mailboxes to return a value. Needs to be more specific. Gavin Wilby IT Support Engineer From: [email protected]<mailto:[email protected]> [mailto:[email protected]<mailto:[email protected]>] On Behalf Of Todd Lemmiksoo Sent: 20 August 2015 21:29 To: [email protected]<mailto:[email protected]> Subject: [Exchange] Powershell to remove email from mailboxes I have to remove a email send to group of people in Exchange 2010. My powershell is returning too many mailboxes. This is my code Get-Mailbox -ResultSize unlimited | Search-Mailbox -SearchQuery "I have been informed" –DeleteContent -WhatIF The search should only return about 40 mailboxes, it is returning hunderds. Suggestions! -- T. Todd Lemmiksoo SMP Partners Limited, SMP Trustees Limited and SMP Fund Services Limited are licensed by the Isle of Man Financial Supervision Commission. SMP Accounting & Tax Limited is a member of the ICAEW Practice Assurance Scheme. SMP Partners Limited registered in the Isle of Man, Company Registration No: 000908V Directors: M.W. Denton, M.J. Derbyshire, S.E McGowan, O. Peck, J.J. Scott, S.J. Turner SMP Trustees Limited registered in the Isle of Man, Company Registration No: 068396C Directors: A.C. Baggesen, M.W. Denton, O. Peck, J.J. Scott, J. Watterson, J. Cubbon SMP Fund Services Limited registered in the Isle of Man, Company Registration No: 120288C Directors: V. Campbell, M.W. Denton, D.A. Manser, S.E McGowan, J.J. Scott, R.K. Corkill SMP Accounting & Tax Limited registered in the Isle of Man, Company Registration No: 001316V Directors: I.F. Begley, A.J. Dowling, P. Duchars, J.J. Scott, S.J. Turner SMP Capital Markets Limited registered in the Isle of Man, Company Registration No: 002438V Directors: M.W. Denton, M.J. Derbyshire, D.F Hudson, S.E McGowan, O. Peck, J.J. Scott. SMP Partners Limited, SMP Trustees Limited, SMP Fund Services Limited, SMP Accounting & Tax Limited and SMP Capital Markets Limited are members of the SMP Partners Group of Companies. This email is confidential and is subject to disclaimers. Details can be found at: http://www.smppartners.com/disclaimer.html ______________________________________________________________________ This email has been scanned by the Symantec Email Security.cloud service. For more information please visit http://www.symanteccloud.com ______________________________________________________________________ -- T. Todd Lemmiksoo -- T. Todd Lemmiksoo
