none
問題說明 : Need to delete an email from all user EXO mailbox RRS feed

  • 一般討論

  • 解決方式:

    下載並執行EXO/Compliance PowerShell (Download with Edge browser only)

    https://aka.ms/exopowershelldownload

    ContentMatchQuery or SearchQuery 請根據需求更改為需搜尋的項目條件,若信件主旨為中文,因為索引的關係,建議使用其他條件代替,詳細資訊請參考Query Keyword:

    Keyword queries and search conditions for eDiscovery - Microsoft 365 Compliance | Microsoft Docs

    即使是最高管理者,因為Purge信件需要特殊權限,第一次執行請先確認有以下必要權限;加入權限後需等待約10分鐘的同步時間,並且需要在完成權限設定後重新開啟Exchange management shell作登入再開始執行動作

     方式一(Exchange Online)

    Search MailboxExchange管理者帳號需要另外加Mailbox Search + Mailbox Import Export權限)

    https://docs.microsoft.com/zh-tw/office365/securitycompliance/search-for-and-delete-messagesadmin-help

            *管理者無法搜尋自己的信箱,請以其他信箱作測試

            *若管理者帳號缺乏必要權限,則即使有符合條件的信件,搜尋結果或刪除結果會顯示為0

    1. 登入Exchange Online的管理者帳號

    Connect-EXOPSSession -UserPrincipalName admin@domain.com

    2. 確定條件符合預期並將信件預估Log匯出 (包含總數量預估與大小)

    Get-Mailbox -ResultSize unlimited | Search-Mailbox -SearchQuery '(subject:"信件主旨") AND (From:sender@domain.com) AND (Attachment:filename.xml)' -EstimateResultOnly | export-csv c:\temp\mail_before.csv

    3. 下同樣條件的指令並匯出詳細資訊至管理者信箱(包含此信件的所有信箱與資料夾位置),以下範例會在管理者admin的信箱建立一個名為Search的資料夾,包含報告附件的通知信會傳送至此位置

    Get-Mailbox -ResultSize unlimited | Search-Mailbox -SearchQuery '(subject:"信件主旨") AND (From:sender@domain.com) AND (Attachment:filename.xml)' -LogOnly -LogLevel Full -TargetMailbox admin@domain.com -TargetFolder "Search"

    4. 直接刪除上述條件之信件

    Get-Mailbox -ResultSize unlimited -ErrorAction SilentlyContinue | Search-Mailbox -SearchQuery '(subject:"信件主旨") AND (From:sender@domain.com) AND (Attachment:filename.xml)' -DeleteContent -Force

    5. 將指定條件的信件從Recoverable Items folder中移除

    Get-Mailbox -ResultSize unlimited -ErrorAction SilentlyContinue | Search-Mailbox -SearchQuery '(subject:"信件主旨") AND (From:sender@domain.com) AND (Attachment:filename.xml)' -SearchDumpsterOnly -DeleteContent -Force

     -SearchDumpsterOnly

    https://docs.microsoft.com/en-us/powershell/module/exchange/mailboxes/Search-Mailbox?view=exchange-ps

    The SearchDumpsterOnly switch specifies that only the Recoverable Items folder of the specified mailbox be searched. You can also use this switch with the DeleteContent switch to delete messages from the Recoverable Items folder and reduce the size of the folder.

    6. 下同樣條件的指令並匯出詳細資訊至管理者信箱,確認信件是否已確實刪除Purge

    Get-Mailbox -ResultSize unlimited | Search-Mailbox -SearchQuery '(subject:"信件主旨") AND (From:sender@domain.com) AND (Attachment:filename.xml)' -LogOnly -LogLevel Full -TargetMailbox "admin@domain.com" -TargetFolder "Search"

    方式二(Compliance-Content Search)

    Search for and delete email messages in your organization - Microsoft 365 Compliance | Microsoft Docs

    • To create and run a Content search, you have to be a member of the eDiscovery Manager role group or be assigned the Compliance Search role in the Microsoft 365 compliance center.
    • To delete messages, you have to be a member of the Organization Management role group or be assigned the Search And Purge role in the compliance center For information about adding users to a role group, see Assign eDiscovery permissions.

    1. 登入安全與合規的管理者帳號

    Connect-IPPSSession -UserPrincipalName admin@domain.com

    2. 建立案例與條件

    New-ComplianceSearch -Name "Case Name" -ExchangeLocation all -ContentMatchQuery '(From:sender@domain.com) AND (Recipients:Recipient@domain.com)'

    3. 開始搜尋案例

    Start-ComplianceSearch -Identity "Case Name"

    4. 確認案例狀態

    Get-ComplianceSearch -Identity "Case Name" | fl

    5. 匯出案例資訊

    Get-ComplianceSearch -Identity "Case Name" | export-csv c:\temp\report.csv

    6. 刪除上述案例內容項目

    New-ComplianceSearchAction -SearchName "Case Name" -Purge -PurgeType HardDelete -confirm:$false

    7. 確認案例執行狀態

    Get-ComplianceSearchAction -Identity "Case Name_Purge" | fl JobProgress,Results


    如果帖子有帮到您的话,请点击左上方“投票”按钮。这将帮助到阅读这个帖子的其他用户。


    2022年9月7日 上午 06:53
    版主