Forum Discussion
Deleting malicious emails from all O365 mailboxes
example below -
PS C:\get-mailbox -ResultSize Unlimited -RecipientTypeDetails UserMailbox | Search-Mailbox -SearchQuery 'subject:"JOB REFERRAL" -DeleteContent -force
'Search-Mailbox : The term 'Search-Mailbox' is not recognized as the name of a cmdlet, function, script file, oroperable program. Check the spelling of the name, or if a path was included, verify that the path is correct and tryagain.At line:1 char:71+ ... Unlimited -RecipientTypeDetails UserMailbox | Search-Mailbox -Search ...+ ~~~~~~~~~~~~~~+ CategoryInfo : ObjectNotFound: (Search-Mailbox:String) [], CommandNotFoundException+ FullyQualifiedErrorId : CommandNotFoundException@stevemorgan
How are you connecting to Exchange Online? I just connected via V2 Module and it ran. Do you have the appropriate roles assigned? Did you reconnect after assigning to reload the appropriate cmdlets?
i am connecting using the microsoft exchange online powershell module and i am a global admin in our tenant
To use the process VasilMichev mentioned earlier with this doc:
https://docs.microsoft.com/en-us/microsoft-365/compliance/search-for-and-delete-messages-in-your-organization?view=o365-worldwide
You'll need to open Admin Center > Scroll down on the left pane and choose the Security admin center (or go to https://protection.microsoft.com)
From there, you'll need to click on permissions and then assign the permissions mentioned in the doc he provided.
After that you can follow the steps using that method. As mentioned Search-Mailbox is end-of-life soon:
"WARNING: WARNING: On July 1, 2020, the Search-Mailbox cmdlet is being retired and Microsoft Support will no longer provide assistance. See https://go.microsoft.com/fwlink/?linkid=2113221 to learn more.
WARNING: The Search-Mailbox cmdlet returns up to 10000 results per mailbox if a search query is specified. To return more than 10000 results, use the New-MailboxSearch cmdlet or the In-Place eDiscovery & Hold console in the Exchange Administration Center."I have fixed the permissions, i did a simple search for a test email i sent from external to internal and came back with 0 results. stevemorgan
Like I quoted earlier, you'll need to assign yourself the appropriate roles in Exchange Online. These aren't assigned by default to anyone; even when you're a Global Admin or part of Organizational Management in EXO. Have you assigned those roles and established a new connection to Exchange Online?
In EXO ECP you can navigate to Permissions > admin roles > click the + to add a new role:
Give it name/descriptionAdd the two roles mentioned in the first Doc I shared
Assign members (yourself) and save.
Give it a few minutes, reestablish a powershell connection to EXO and try again.
There are some Exchange permissions that are required to remove the emails.
