Deleting a Specific Email from all Exchange Mailboxes Using Powershell (eg. Spam, Phishing, Virus)

If your organisation receives a dodgy email, or someone within your organisation forwards one, here is a PS one-liner to delete it from all mailboxes in Exchange 2010

Get-Mailbox -ResultSize Unlimited | Search-Mailbox -SearchQuery 'Subject:"*Anlieferung Ihrer  Sendung 35171196631*"' -DeleteContent

Obviously, you will need to make sure your search term only targets that specific email. Luckily in the case above, it is a very unique email subject!

It is also recommended to type this command out manually, rather than copying from the page. Single and double quotes can get lost in the translation!

You can preview how many messages will be deleted by replacing -DeleteContent with -EstimateResultOnly

The more mailboxes and emails you have, the longer this will take to complete.

Another useful example is when someone accidentally sends an email to the entire company. This can be used so that the sender and intended recipient still keep their email, but everyone else does not.

Get-Mailbox -ResultSize Unlimited |?{$_.DisplayName -ne "Name of Sender"} |?{$_.DisplayName -ne "Name of Intended Recipient"}|Search-Mailbox -SearchQuery {Subject:"Subject title to search for" AND From:"Name of Sender"} -deletecontent

This does not search any PST files a user has, just their Exchange mailbox