Read time: 5 minutes
The Exchange Management Shell provides the administrator with a means to gain firm control over the Exchange environment. You can search, delete, recover, move, etc., operations on user mailboxes using the Search-Mailbox cmdlet in Exchange Management Shell (EMS). While it may not offer the same user-friendly experience as the Exchange admin center, it excels in performing a broader range of tasks with greater comprehensiveness. In this discussion, we will explore the utilization of the Search-Mailbox command to search and delete messages from Exchange user mailboxes.
Note:The Search-Mailbox cmdlet only works with an on-premises server. If you are working with Microsoft 365 or Exchange Online, you must use the New-ComplianceSearch cmdlet.
What is the Search-Mailbox cmdlet?
Search-Mailbox, a PowerShell cmdlet, allows easy search and deletion of messages from one or multiple mailboxes. It can help you get rid of messages that you no longer need. With different parameters available, it allows you to specify the target mailboxes, search criteria, and suitable actions when a value is matched. Some critical parameters required for executing the query to search and delete Exchange user mailboxes are mentioned below:
- TargetMailbox: Defines the destination/target mailbox where search results are copied once found. You can define values that uniquely pinpoint the mailbox. For example, Name, Alias, Email address, GUID, etc.
- DeleteContent: The switch tells that whenever a match is found, the message is permanently deleted from the source mailbox. Using it with the TargetMailbox parameter yields copying the messages to the target mailbox while deleting them from the source mailbox.
- Force: It hides the messages showing warnings and confirmation. No need to define a value with this switch.
- Identity: Provides you with the identity of a mailbox that you want to search. You can define values that help to identify the mailbox uniquely.
- LogOnly: It will perform a search but only provides a log. Messages that are found using this switch aren’t copied to the target mailbox.
- Search Query: It defines the search parameters used to find out the messages in a mailbox using criteria such as keywords, message size, and others.
Why do administrators search and delete messages?
Your organization’s administrator can use the Search-Mailbox cmdlet for various reasons, some of which are:
- Delete Messages: Human errors like choosing the Reply-All (in an email) option in an organization with 10,000+ members can cause disturbance. With the Search-Mailbox cmdlet, admin can search & delete messages from Exchange user mailboxes.
- Recover Messages: In addition to deletion, the command also helps to recover deleted emails/messages from Exchange mailboxes (from the Recoverable Items folder).
- Transfer Messages to New Mailbox: With the Search Query parameter, search and transfer emails in bulk from different mailboxes to a common target mailbox.
- To Abide by Compliance Laws: Another popular reason to use this EMS command is to comply with data compliance rules by purging specific types of emails from all the mailboxes in the Exchange Server.
What are the requirements for using Search-Mailbox cmdlet?
Before starting the process to search & delete email messages, make sure that:
- The account has the Mailbox Search role (for searching for messages) and the Import Export role (to delete messages) assigned. These roles are not assigned to the administrator by default. To assign them, run the following commands in EMS.
Mailbox Import Export Role:
New-ManagementRoleAssignment -User <username> -Role “Mailbox Import Export”
Mailbox Search Role:
New-ManagementRoleAssignment -User <username>-Role “Mailbox Search”
- The user must know how to use Exchange Management Shell to run the cmdlets.
- The facility is available for on-premises Exchange Server 2010 and later versions of Exchange Server.
How to search and delete messages from mailboxes?
To start with, run the Exchange Management Shell application as an administrator.
Search Messages
The below cmdlet is for searching specific message(s) in the user mailboxes. Just provide your mailbox name and specific phrase or words, and the target folder name where you want to save the data.
For Example:
Delete Messages
The command below will help you search & delete messages from Exchange user mailboxes containing a specific phrase in the subject.
However, in case you want to paste the messages to a folder before deletion, use the TargetMailbox & TargetFolder switch. Run this command, it copies the messages to target folder and deletes those messages from the source mailbox folder.
Note: Limitations of the Search-Mailbox cmdlet
- The Search-Mailbox has a limit to performing multiple mailbox searches, up to 10,000 mailboxes.
- The search results when performing Search-Mailbox with -SearchQuery are limited to a maximum of 10,000 results per mailbox.
How to search and delete messages from an inconsistent database?
To use Search-Mailbox cmdlet, your database must be healthy and mounted on the server. But what will you do if the database is in a Dirty Shutdown state due to which the EDB file is dismounted? The only possible way forward is to fix the EDB file, make it consistent again, and mount it back on the server.
To repair EDB files, the first tool that comes to mind is the eseutil command-line utility. Use the soft recovery to replay the uncommitted logs and turn the database back to a Clean Shutdown state. However, in case the inconsistency is caused due to corrupt database pages, you have to use the hard recovery option, but it will cause data loss.
If losing data is not an option, use Exchange database recovery tool, like Kernel for Exchange Server. The tool allows admins to repair and recover mailboxes from a corrupt, inconsistent, or orphaned EDB file without losing a single email in the process. After recovery, save the data to PST or restore the mailboxes directly from EDB to Live Exchange or Office 365.
Conclusion
The Search-Mailbox cmdlet is a powerful command, use it with care. Any action you perform with it is permanent. Therefore, before you search & delete messages from Exchange user mailboxes, make sure to back them up.
In case the EDB file is dismounted, fix it with the eseutil tool. If the native tool fails to help, use the Kernel for Exchange Server to recover mailboxes from the EDB file.
Frequently Asked Questions
Ans. If the database is healthy and mounted use the Search-Mailbox cmdlet with the SearchDumpster switch. However, in case the EDB file is orphaned, use an EDB to PST converter tool.
Ans. Use the Microsoft Purview portal to find the messages and delete them from all the mailboxes.
