hi,

have a hybrid scenario, exchange 2013 and office 365

what command should I use to search and delete an email from the organization mailbox i.e. I do not want that email to be in any users inbox.

I have tried this command but it does not work, it says search-mailbox is not recognized as the name of the command let.

Get-Mailbox -ResultSize unlimited | Search-Mailbox -SearchQuery 'Subject:"Download this file"' -DeleteContent

kindly a

Hi Khuzema

This can be accomplished by search-mailbox command

First you need to create a new role group

To Create   New-RoleGroup Mailbox Import-Export Management -Roles Mailbox Import Export

Then add the user to the group

To Add user Add-RoleGroupMember Mailbox Import-Export Management -Member Administrator

Search the mailbox

get-mailbox -ResultSize unlimited -IgnoreDefaultScope | search-mailbox -SearchQuery Subject:virus infected -LogOnly -TargetMailbox administrator -TargetFolder filter -LogLevel Full

Now we need to run the below command to search the infected emails and delete all of them in the whole organization

get-mailbox -ResultSize unlimited -IgnoreDefaultScope | search-mailbox -SearchQuery Subject:virus infected -TargetMailbox administrator -TargetFolder filter -deletecontent -LogLevel Full

Also you can do a message tracking with the subject and delete them

Get-ExchangeServer | where {$_.isHubTransportServer -eq $true -or $_.isMailboxServer -eq $true} | Get-MessageTrackingLog -Messagesubject Virus Infected | Select-Object Timestamp,ServerHostname,ClientHostname,Source,EventId,Recipients | Sort-Object -Property Timestamp

I have written a blog with regards to the same. You can always refer this which might mostly  help you in your scenario

http://exchangequery.com/2014/10/16/steps-to-delete-circulated-suspicious-emails-with-search-mailbox/

Thanks 

Hi,

On more thing, your account should also be a member of the Discovery Management role to run Search-Mailbox cmdlet. Try this command to add your account to Discovery Management role group

Add-RoleGroupMember -Identity "Discovery Management" -Member Administrator.

Search-Mailbox

https://technet.microsoft.com/en-us/library/dd298173%28v=exchg.150%29.aspx?f=255&MSPPError=-2147217396

Best Regards.

Hi Satish,

Thank you very much for your reply. I followed your instructions but I get this error.

kindly let me know what I have to do next.