Little intro

I’ve got a case where the customer wanted to delete all of his users’ data in their mailboxes on the Exchange Server, that they got before 1-JAN-2018. He has an incident happened with some leaked critical email messages and he wanted to prevent it by taking this action!

The way to do this of course is pure PowerShell. So I first had to analyze the requirements then build an image in my brain for how the work is going to happen, then test it. And finally implement the needed changes.

Basically what I came to put together is, first I need to backup the data that I will delete. Then I need to delete the data.

To backup the data I need to export the mailboxes to a PST file. And the delete the data I have to use the Search-Mailbox cmdlet with -SearchQuery property.

That was the most simple outline for the work I could come up with.

Details?

So to make sure I get it right, I put the following list of actions that I need to make:

1. Make sure the admin user I’ll be using have access to New-MailboxExportRequest cmdlet.
   If it has no access, then I’ll use this command to add it:

   New-ManagementRoleAssignment –Role "Mailbox Import Export" –User Administrator

2. Then get a list of all users that I’ll work on with:

   Get-Mailbox | select PrimarySmtpAddress | Export-CSV ~\userList.csv -NoTypeInformation

3. After this create the mailbox export request with the -ContentFilter with the proper search filter which should be something like:

   New-MailboxExportRequest -ContentFilter {(Sent -lt '01/01/2018') -or (Received -lt '01/01/2018'} -Mailbox ..........

4. Once all the export process is completed, then I’ll use the below to search and delete the messages that are to be deleted:

   Search-Mailbox -Identity ""  -SearchQuery "Received: < $("2018/1/1") OR Sent: < $("2018/1/1")"

So once I completed the above commands things worked as needed and I was able to complete the requirements.

Disclaimer: The Microsoft Exchange Server 2010 logo is a property for Microsoft which I have no affiliation with nor own it. I only used it in this site for demonstration purposes only.

Checkout my other blog posts here.