Hello guys,

I am looking for a query that allow me to find and delete from end-user mailboxes,  any email that has a .CAB on it.

This is the query I am using:

>  Import-CSV "C:\Users\y-exa56\Desktop\users1.csv" | %{Search-Mailbox -identity $_.names -SearchQuery 'attachment:"*.cab"' -DeleteContent -TargetMailbox "message" -TargetFolder "Delete_Item" -loglevel Full -Confirm:$False -force}

The problem I have with this query is that it is causing false/positives... it deletes the messages that have a .cab attachment, but it is also deleting emails with .xlsx attachment.

Could you please advise how to adjust this query, so I can delete the emails that have a .cab file as attachment???

Appreciate your help in advance,

--Esteban

My understanding is that wildcards (the asterisk in your example) aren't

Hi,

Try this command

get-mailbox -resultsize unlimited | search-mailbox -SearchQuery "attachment:cab" -DeleteContent

Another thread

https://social.technet.microsoft.com/Forums/en-US/f4b1e6d7-cd82-4588-916b-2a5e4bf76086/remove-delete-cab-files?forum=exchange2010

Best Regards.