As administrators I’m sure you’ve had plenty of requests to delete emails without touching the recipient’s mailbox. Whether it be because of user error or user request.
It’s comforting to know you can do this using the Exchange management shell without impacting the user’s day. With Exchange Server 2016 it’s as easy as one or two commands, the following steps can be carried out to achieve this.
The first command below looks at searching just one mailbox for an email based on an email subject
Search-Mailbox -Identity “Username” -SearchQuery ‘Subject:”email subject”‘ -TargetMailbox “administrator” -TargetFolder “DeleteEmails” -LogOnly -DeleteContent
However, if it is easier, you could instead or also search based on date or sender, instead of ‘Subject:’ you would simply use ‘Date:’ or ‘From:’
If you have a different issue whereby multiple users were sent the email instead you could use the below to search all mailboxes for that email
Get-Mailbox -ResultSize Unlimited | Search-Mailbox -SearchQuery ‘Subject:”email subject”‘ -TargetMailbox “administrator” -TargetFolder “DeleteEmails” -LogOnly -DeleteContent
Finally, if you just want to see whether that email was sent to the mailbox/mailboxes in question you could instead run the following, which instead only queries Exchange, rather than looking at deleting the email in question:
Search-Mailbox -Identity “Username” -SearchQuery ‘Subject:”email subject”‘ -TargetMailbox “administrator” -TargetFolder “DeleteEmails” -LogOnly
Please change the commands to fit your needs i.e the identity to be the mailbox you are after & targetmailbox being where to log all deletions.
Hopefully this helps someone who just like us regularly has similar requests.