Requiremens: Account must be a member of the Discovery Management role.
To search and delete messages in one step, run the Search-Mailbox cmdlet with the DeleteContent switch. However, when you do this, you can't preview search results or generate a log of messages that will be returned by the search, and you may inadvertently delete messages that you didn't intend to. To preview a log of the messages found in the search before they're deleted, run the Search-Mailbox cmdlet with the LogOnly switch.
This example searches all mailboxes in your organization for messages that contain the words "election", "candidate", or "vote". The search results are copied to the Discovery Search Mailbox in the folder AllMailboxes-Election. (not searched in subject line).
Get-Mailbox | Search-Mailbox -SearchQuery 'election OR candidate OR vote' -TargetMailbox "Discovery Search Mailbox" -TargetFolder "AllMailboxes-Election" -LogLevel Full
Delete messages:
Search-Mailbox -SearchQuery 'election OR candidate OR vote' -DeleteContent
Troublesooting 1:
Check mailbox database configuration:
Get-MailboxDatabase | Format-Table Name,IndexEnabled
Check the database copy indexing health
Get-MailboxDatabaseCopyStatus -Server $env:ComputerName | Format-Table Name,Status,ContentIndex* -Auto
Test Exchange Search functionality for a Mailbox server, a mailbox database, or a specific mailbox.
Test-ExchangeSearch
Make sure the status of Content Index Status is seen as healthy.
Get-MailboxDatabaseCopyStatus
Rebuild Search Index:
Possible Content Index State:
Unknow, Crawling
Troublesooting 2:
If you have error: "A parameter cannot be found that matches parameter name 'DeleteContent'."
1. Login to ECP
2. Click “Permissions”
3. Click “admin Roles”
4. Double click on “Organization Management”
5. Add “Mailbox Import Export” role
6. Check your account is in the member list. If not add your account into the list
7. Wait for a while then try the cmdlet again.
