Microsoft Exchange References

Query Email and Purge Required Emails

#Requires -RunAsAdministrator

cls

# Variables
$Computer = $env:COMPUTERNAME
$RemoteExchangeSrv = "Remote-Exchange-Server-Name"

# ****************** Update with Requried Information ******************
$MessageSubject = "xxx"  # Requested email with specific subject to be purged
$Attachment = "xxx"
$UserMailbox = "xxx"       # Required user mailbox to be searched
$UserMailbox1 = "xxx"      # Required user mailbox to be searched
$UserMailbox2 = "xxx"      # Required user mailbox to be searched

# Multi-mailboxes
$VerifyMailboxes = ($UserMailbox1,"xxxx")

*******************************************************************************************************************
$TargetMailbox = "Mail_Search_Request"    # Result will be sent to the target mailbox for verification
$TargetFolder = "Request"                 # Result will be sent to the target folder in the target mailbox
*******************************************************************************************************************



# ------------------------------------------------------
# Main
# ------------------------------------------------------

# Connect with Exchange Management Shell
# This script will run on Exchange server locally
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri "http://$Computer/PowerShell/" -Authentication Kerberos

# If run again remote Exchange server
<#
$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri "http://$RemoteExchangeSrv/PowerShell/" -Authentication Kerberos
#>

Import-PSSession $Session -AllowClobber -DisableNameChecking


#*********** Query & Report only **************
Get-Mailbox -Identity $UserMailbox | Search-Mailbox -SearchQuery 'Subject:"abc*" OR Subject:"def*" or Body:"abc*" OR Body:"def*" AND Received:"07/20/2017 00:01..08/06/2015 23:59″' -TargetMailbox $TargetMailbox -TargetFolder $TargetFolder -LogOnly -LogLevel Full

#*********** Query & Collect the required messages **************
Get-Mailbox -Identity $UserMailbox | Search-Mailbox -SearchQuery 'Subject:"abc*" OR Subject:"def*" or Body:"abc*" OR Body:"def*" AND Received:"07/20/2017 00:01..08/06/2015 23:59″' -TargetMailbox $TargetMailbox -TargetFolder $TargetFolder


#*********** Search multiple mailboxes **************
# Query and Report only - Search Subjetc & Body
ForEach ($mailbox in $VerifyMailboxes) {
    Get-Mailbox -Identity $mailbox | Search-Mailbox -SearchQuery 'Subject:"abc*" OR Subject:"def*" or Body:"abc*" OR Body:"def*" AND Received:"07/20/2017 00:01..08/06/2015 23:59″' -TargetMailbox $TargetMailbox -TargetFolder $TargetFolder -LogOnly -LogLevel Full
}

# ********** Check Attachment **********
# Check and Clean on required mailbox - Search attachment
Get-Mailbox -Identity $UserMailbox | Search-Mailbox -SearchQuery 'attachment:xxxxxxxxxx' -TargetMailbox $TargetMailbox -TargetFolder $TargetFolder -DeleteContent -Force

# Check and Clean all mailboxes - Search attachment
Get-Mailbox -ResultSize unlimited | Search-Mailbox -SearchQuery 'attachment:xxxxxx' -TargetMailbox $TargetMailbox -TargetFolder $TargetFolder -DeleteContent -Force

# Check and Report on all mailboxes - Search attachment
Get-Mailbox -ResultSize unlimited | Search-Mailbox -SearchQuery 'attachment:"xxxxxx"' -TargetMailbox $TargetMailbox -TargetFolder $TargetFolder -LogOnly -LogLevel Full

# ********** Check Subject **********
# Clean up single mailbox
Get-mailbox -Identity $UserMailbox | Search-Mailbox -SearchQuery 'Subject:"$MessageSubject"' -TargetMailbox $TargetMailbox -TargetFolder $TargetFolder -DeleteContent -Force

# Clean up all mailboxes
# Get-Mailbox -ResultSize unlimited | Search-Mailbox -SearchQuery 'attachment:xxxxxx' -TargetMailbox $TargetMailbox -TargetFolder $TargetFolder -DeleteContent -Force