Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Question
Monday, November 19, 2018 9:47 PM
Now that the search-mailbox powershell command maxes out at 10,000 results in Exchange 2016 when the -SearchQuery is added to the command what is the preferred method for deleting a large number of messages from a single mailbox.
I am looking to delete all messages on a single mailbox for a given timeframe (1 week)
I see the cmdlet New_MailboxSearch is the preferred command for returning more than 10,000 results but I do not see how I can delete said messages from a mailbox.
Rerunning the command multiples times is not an acceptable alternative
All replies (10)
Monday, November 26, 2018 6:59 PM ✅Answered
I found the answer. Search-Mailbox uses UTC time so you need to base your queries off that time zone. Plus I needed to change the timeformat a little bit. The Z at the end of the time format indicates UTC time.
Search-Mailbox MailArchive -SearchQuery 'Received>= "2018-11-05T08:00:00Z" AND Received<= "2018-11-06T07:59:59Z"' -DeleteContent -Force
Tuesday, November 20, 2018 4:24 AM
Check out this post https://social.technet.microsoft.com/Forums/ie/en-US/f5ac72c8-aed5-4fce-9764-5063c0a37a9e/delete-greater-than-10000-messages?forum=exchangesvradmin
Search, Recover, Export Mailboxes, Contacts, Calendars, Tasks from ALL versions of Exchange Offline EDB's, On-Premises Exchange Databases & Office 365. Export, Migrate/Recover into On-Premises Exchange Server, Office 365 with Lucid8's DigiScope
Tuesday, November 20, 2018 6:47 AM
Hi,
You can use the command Search-Mailbox with DeleteContent switch to delete items received to or sent from the mailbox in a time interval.
Search-Mailbox -Identity <alias> -SearchQuery ‘(sent:mm\dd\yyyy..mm\dd\yyyy) AND (received:mm\dd\yyyy..mm\dd\yyyy)’ -DeleteContent
Before doing this, you need to add the Discovery Management role and Mailbox Import Export role to the administrator. Add the Discovery Management role:
Add-RoleGroupMember -Identity "Discovery Management" -Member <Identity>
Add the Mailbox Import Export role:
New-ManagementRoleAssignment -SecurityGroup "Organization Management" -Role "Mailbox Import Export"
Add-RoleGroupMember -Identity "Organization Management" -Member <Identity>
Regards,
Dawn Zhou
Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact [email protected].
Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.
Tuesday, November 20, 2018 3:38 PM
Hi,
Check out this article: https://www.codetwo.com/admins-blog/how-to-delete-email-from-mailboxes-on-exchange-2016-2013-2010-online/. It shows how to delete emails from mailboxes on Exchange 2016.
All the best,
Adam
CodeTwo: Software solutions for Exchange and Office 365
Tuesday, November 20, 2018 4:12 PM
Hi,
You can use the command Search-Mailbox with DeleteContent switch to delete items received to or sent from the mailbox in a time interval.
Search-Mailbox -Identity <alias> -SearchQuery ‘(sent:mm\dd\yyyy..mm\dd\yyyy) AND (received:mm\dd\yyyy..mm\dd\yyyy)’ -DeleteContentBefore doing this, you need to add the Discovery Management role and Mailbox Import Export role to the administrator. Add the Discovery Management role:
Add-RoleGroupMember -Identity "Discovery Management" -Member <Identity>Add the Mailbox Import Export role:
New-ManagementRoleAssignment -SecurityGroup "Organization Management" -Role "Mailbox Import Export" Add-RoleGroupMember -Identity "Organization Management" -Member <Identity>Regards,
Dawn Zhou
Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact [email protected].
Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.
In Exchange 2016 when you add the -SearchQuery property you are limited to 10,000 results.
Additinally, the DeleteContent switch does not appear to be a valid switch for Search-Mailbox in Exchange 2016.
I am looking for a way to not have to have to runt his multiple times . . .or using a DO While loop.
Tuesday, November 20, 2018 6:01 PM
Hi,
Check out this article: https://www.codetwo.com/admins-blog/how-to-delete-email-from-mailboxes-on-exchange-2016-2013-2010-online/. It shows how to delete emails from mailboxes on Exchange 2016.
All the best,
Adam
CodeTwo: Software solutions for Exchange and Office 365
The DeleteContent switch does not work for Search-Mailbox in 2016.
Tuesday, November 20, 2018 6:49 PM
The command on my Exchange 2010 box is below and works just fine:
Search-Mailbox MailArchive -SearchQuery "Received:>= 11-05-2018 00:00:00 and Received:<= 11-06-2018 23:59:59" –DeleteContent -Force
The same command on my Exchange 2016 box produces the "The Property isn't supported" alert.
If I remove the time stamps the command appears to work on the Exchange 2016 box but is not deleting all the messages that I need deleted. If I rerun the same command again no additional messages are deleted.
I erroneously assumed the error was coming from my -DeleteContent switch. That is my fault.
Wednesday, November 21, 2018 6:49 PM
This might have something to do with the failed content index. See this guide for details: https://practical365.com/exchange-server/exchange-2016-failed-content-index/.
CodeTwo: Software solutions for Exchange and Office 365
The cmdlet results in a Content Index State of healthy. Thanks for the suggestion.
Friday, November 23, 2018 10:35 AM
Hi,
According to your description, you should carefully investigate the condition and syntax within the searchquery. Try to add the single quotation for each condition, use AND instead of and, change the date format and check the results.
Search-Mailbox MailArchive -SearchQuery "'Received:>= 11/05/2018 00:00:00' AND 'Received:<= 11/06/2018 23:59:59'" –DeleteContent -Force
Regards,
Dawn Zhou
Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact [email protected].
Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.
Friday, November 23, 2018 2:30 PM
Hi,
According to your description, you should carefully investigate the condition and syntax within the searchquery. Try to add the single quotation for each condition, use AND instead of and, change the date format and check the results.
Search-Mailbox MailArchive -SearchQuery "'Received:>= 11/05/2018 00:00:00' AND 'Received:<= 11/06/2018 23:59:59'" –DeleteContent -ForceRegards,
Dawn Zhou
Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact [email protected].
Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.
Running this exact command on my Exchange 2016 box produces the "The property keyword isn't supported".
If I remove the time stamp the command works fine.
Does it work your exchange 2016 box with the time stamp included?