How to search and delete specific phishing email from all mailboxes

[GuillermoN]

Hi Everyone! We recently received a couple of phishing emails at our company. We have a 3-node Exchange 2019 cluster. I have been assigned the task of deleting these emails. First, I ran this command to find out the amount of received emails:

Get-Mailbox -ResultSize Unlimited | Search-Mailbox -SearchQuery 'subject:"subject of the phishing email"'

And I got this error: The path of the destination mailbox or .pst file is required

My idea is to test first and then run this command to delete the emails:

Get-Mailbox -ResultSize Unlimited | Search-Mailbox -SearchQuery 'subject:"subject of the phishing email" AND from:"email-phishing-sender"' -DeleteContent

Am I on the right path? Could you help me with the right steps to do this task?

Thanks in advance!

[#2]

To test, add the -EstimateResultsOnly switch to your first cmdlet. If everything seems OK, run the second one.

[#3]

Hi @VasilMichev! Thanks for your help. I tried with -EstimateResultsOnly switch and I got this:

No parameter found matching parameter name 'EstimateResultsOnly'

[#4 · Accepted solution]

It's EstimateResultOnly, my bad. Use tab 🙂