Wednesday, 14 October 2015

Exchange 2010, 2013, 2016 - Delete virus email from mailboxes using Search-Mailbox

Occasionally but hopefully not too often you may get a virus that bypasses your spam filters and ends up in end users' mailboxes. In this post, I'll demonstrate how to delete the email from users' mailboxes in one quick and easy command which you can have on hand to run quickly.

A classic spam email with a zip attachment is below:

First, ensure you have the correct permissions:

  1. Log into the Exchange Admin Center using an account that is a member of the Organization Management AD Group
  2. Click on Permissions
  3. Double click on Discovery Management and add your user account as a member
  4. Open a new Exchange Management Shell

To delete the email from all users' mailboxes:

Run the below command on a single line:

Get-Mailbox -ResultSize Unlimited | Search-Mailbox -SearchQuery,subject:invoice -DeleteContent -Force

Above, you can see a report where it shows that one email was deleted from the Administrator mailbox (ResultItemCount: 1). 

To delete an email from all mailboxes and copy the email to the Spam mailbox

Get-Mailbox -ResultSize unlimited | Search-Mailbox -SearchQuery,subject:invoice -TargetMailbox Spam -TargetFolder DeletedMessages -DeleteContent

To delete an email according to the attachment file name

Get-Mailbox -ResultSize unlimited | Search-Mailbox -SearchQuery -DeleteContent


  1. Please change the title, this does not work on Exchange 2016 as Search-Mailbox is now limited to 10000 results.
    And New-MailboxSearch does not seem to support -deletecontent no matter what roles I assign myself.

  2. It is very informative. You have given a fresh outlook on the topic. I would definitely share this on other platforms as well.
    Keep your system protected at all times with the Real-Time Best Antivirus for window feature.
    ITL good antivirus program continuously scans your system in real-time to keep it safe from all active infections.

  3. microsoft had hotmail
    Hotmail / Outlook supports Active View that lets you interact with the contents of the mail in the same window. With the support of the functionalities of various sites like YouTube, Flickr, LinkedIn, it allows you to play any YouTube video through the link in the same window or view a profile in the same page. It thus reduces much effort, earlier required to change apps or tabs in the browser.

  4. Thanks for a wonderful share.Your article has proved your hard work and experience you have got in this field.Brilliant.
    deep cleaning coronavirus

  5. Yes, well said. Sanitizers are the real way to get protected by deadly viruses. Thanks for sharing this valuable content in here.