Search your Exchange environment for content in mails with PowerShell

This post may be a little controversial due to the possible legal implications when you use the scripts I’ll provide. Nevertheless, here we go Emoticon met brede lach

Or maybe some users are mailing secret content around inside the company which they are not (yet) allowed to… because it’s supposed to be a secret!
* Or just when you suspect someone is talking smack about you…*

Let’s take a situation where you have content that is not allowed to be mailed about, or at least not outside a specific group of people. You can accomplish that with some native Exchange functionalities… but not every company has implemented this and by the time this is properly done it may be too late.

So, to scan your environment and copy the mails it finds to a specific mailbox:

Get-Mailbox –Database DB1 | New-MailboxExportRequest -Mailbox -ContentFilter {Body -like “*Jeff*”} –TargetMailbox Administrator –TargetFolder ‘ContentScan1’

Or when, for example, students are mailing a ‘funny’ picture of a teachter to eachother…

Get-Mailbox –Database DB1 | New-MailboxExportRequest -Mailbox -ContentFilter {(Body -like “*Jeff*”) –And (Attachment -like “*clown*.jpg”)} –TargetMailbox Administrator –TargetFolder ‘ContentScan1’

But let’s go crazy and assume that you actually want to search for mails consisting of some content and attachment, and some mails based on content in the subject…

Get-Mailbox –Database DB1 | New-MailboxExportRequest -Mailbox -ContentFilter {(Body -like “*Jeff*”) –And (Attachment -like “*clown*.jpg”) –or (Subject -like ‘*Jeff*’)} –TargetMailbox Administrator –TargetFolder ‘ContentScan1’

Big fat note: Although these are some very powerfull oneliners, there is a little thing called ‘privacy’. Please read the law in your country to investigate if and how you are allowed to use this!!!


  1. Nate says:

    How do we search for a word in attachment files

  2. PowerMapi says:

    There’s a new option for this task that can be done even on non-exchange systems, or against PST files: PowerMapi.
    PowerMapi is a powershell module compiled in .NET that provides a set of cmdlets to do mapi things.

    Here’s a true example of how searching and deleting items in mailbox can be done:

    import-module PowerMapiLoader
    $sess=new-MapiSession OutlookProfileName
    $inbox=get-MapiFolder $sess Inbox
    $toDelete=search-MapiItems $inbox “PR_SUBJECT -has check this out! -and PR_MESSAGE_DELIVERY_TIME -btw 12/1/2016::1/1/2017”
    $toDelete | %{ remove-MapiItem $inbox $_ }

    Consider the simplicity of the search string and the -btw (between) operator for the date range!

    One could review the search results before deleting by outputting the $toDelete variable. Since this is MAPI, outlook does not need to be running and other mailboxes can be opened (as long as permissions allow) and searched as well.

    Take a look at the list of cmdlets here:

Leave a Reply

Your email address will not be published. Required fields are marked *