This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(147.20000000000002, 24%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGC%3C/text%3E%3C/svg%3E)
Hi,
We have an Exchange Server 2013 and run the following command to export the email in a user's mailbox for a specified date range:
New-MailboxExportRequest -Mailbox <mailbox> -ContentFilter {(received -ge '01/01/2016') -and (received -le '12/31/2018')} -FilePath "UNC-path\export.pst" -BadItemLimit 10
The emails in the mailbox are exported successfully.
We then run the following PowerShell command on the user's mailbox to delete all the emails within the date range:
search-mailbox -identity <identity> -searchquery {(received -ge '01/01/2016') -and (received -le '12/31/2018')} -deletecontent -force
All emails in that date range are deleted except for two emails that still remain in the sent folder of the user's mailbox.
What could be causing the two emails to not be deleted? How, can we ensure that all items in the mailbox within that date range are deleted?
Regards,
@Georges Carraha
It looks like they belong to sent mail rather than received mail.
If the suggestion below helps, please feel free to accept it as an answer to help more people.
Can you delete them manually?
I suspect they may be corrupt in some way and that command cant remove.
I assume it removed all the other items in the sent folder
Hi,
The PowerShell command deleted all other emails in that folder within that date range. I am able also able to open those emails and delete them manually.
weird. Ok, I have no explanation other than the command just barfed on those for some reason even though they matched the search criteria :(
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(256, 74%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERM%3C/text%3E%3C/svg%3E)
Would a message in the Sent Items folder necessarily have a "received" date??? Just asking.
lol. Prb not! But I wonder why the others in that folder were deleted...
The command worked for the other emails in the sent folder. So I do not think that is the issue. However, I had also tried the command below and it made no difference:
search-mailbox -identity <identity> -searchquery {(sent -ge '01/01/2016') -and (sent -le '12/31/2018')} -deletecontent -force
I haven't touched an Exchange server for almost eight years, so I'm not anywhere authoritative . . . however, if the help for the search-mailbox cmdlet is correct, it uses the KQL syntax for the "-SearchQuery" parameter's argument. If that's the case, shouldn't the query be something like this?
sent:(01/01/2016..12/31/2018)
Hi,
Both formats for the -SearchQuery are acceptable.
Regards,
You can also use the command below to check whether those two emails are contained in the filter:
The command below will return the number of emails that contained in this filter
search-mailbox -identity <identity> -searchquery {(received -ge '01/01/2016') -and (received -le '12/31/2018')} -EstimateResultOnly
If the result does not contain emails, it means you need to filter for those two emails.
One thing you need to notice: The Search-Mailbox cmdlet returns up to 10000 results per mailbox if a search query is specified, the emails that need to be deleted may exceed this limit.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Hi,
I ran the command and it returned 0 bytes:
search-mailbox -identity <identity> -searchquery {(received -ge '01/01/2016') -and (received -le '
12/31/2018')} -EstimateResultOnly
WARNING: The Search-Mailbox cmdlet returns up to 10000 results per mailbox if a search query is specified. To return
more than 10000 results, use the New-MailboxSearch cmdlet or the In-Place eDiscovery & Hold console in the Exchange
Administration Center.
RunspaceId : 72c33216-eafd-4206-889e-1cd738fdfc30
Identity : <identity>
TargetMailbox :
Success : True
TargetFolder :
ResultItemsCount : 0
ResultItemsSize : 0 B (0 bytes)
The strange thing is that I used the same date range in the filter to export the mailbox to a PST and the resulting PST contained ONLY those two emails. The command I used was below:
New-MailboxExportRequest -Mailbox <nailbox> -ContentFilter {(received -ge '01/01/2016') -and (received -le '12/31/2018')} -FilePath "UNC-path\export.pst"
I'm not sure what other criteria I can use in the filter to remove just those two emails. It would not be a concern if it was only one users mailbox with the problem but there are several mailboxes with a similar issue. Identifying the folders with the emails that cannot be removed in each users mailbox will be time consuming and that is why I'm using the powershell script.
I inspected those two specific emails. When I open the properties, I see that the internet headers section is blank.
Regards,
Hi
In the filter I changed "received" to "sent". So when I ran the command below:
search-mailbox -identity <identity> -searchquery {(sent -ge '01/01/2016') -and (sent -le '12/31/2018')} -EstimateResultOnly
I get the result:
RunspaceId : 7ef555b0-1784-4ac0-bf05-f561ba0e3c65
Identity : : <identity>
TargetMailbox :
Success : True
TargetFolder :
ResultItemsCount : 5
ResultItemsSize : 2.744 MB (2,876,811 bytes)
Regards,
Then you could use the command below to export them to another mailbox, logon that mailbox you will know whether they are emails that you want:
search-mailbox -identity <identity> -searchquery {(sent -ge '01/01/2016') -and (sent -le '12/31/2018')} -TargetFolder test -TargetMailbox AnotherMailbox
Hi,
Exporting the emails is not the issue as stated in the original post. We have already done that with the command:
New-MailboxExportRequest -Mailbox <mailbox> -ContentFilter {(received -ge '01/01/2016') -and (received -le '12/31/2018')} -FilePath "UNC-path\export.pst" -BadItemLimit 10
The problem is that we cannot delete all the emails within the date range specified using the command below:
search-mailbox -identity <identity> -searchquery {(received -ge '01/01/2016') -and (received -le '12/31/2018')} -deletecontent -force
Some emails get left behind.
Regards,
Yes, I know. What I mean is to use the above command to detect whether there is an issue with the filter.
As you said, there return 0 email when you use the command below, it means that those two emails don't contained in this filter:
search-mailbox -identity <identity> -searchquery {(received -ge '01/01/2016') -and (received -le '12/31/2018')} -EstimateResultOnly
I inspected those two specific emails. When I open the properties, I see that the internet headers section is blank.
Based on this one, I guess those two emails are "sent" rather than "received", so, I suggest you use the second command to check whether those two emails are contained in this filter.
If you could find them when using "received", it is normal phenomenon that you cannot delete them when using "received" as filter.
Hi
You state "Based on this one, I guess those two emails are "sent" rather than "received", so, I suggest you use the second command to check whether those two emails are contained in this filter."
Which command are you referring to?
At the moment, if I run the command below it returns 0:
search-mailbox -identity <identity> -searchquery {(received -ge '01/01/2016') -and (received -le '12/31/2018')} -EstimateResultOnly
If I change "received" to "sent" in the filter, it also returns 0.
The command below:
search-mailbox -identity <identity> -searchquery {(received -ge '01/01/2016') -and (received -le '12/31/2018')} -deletecontent -force
gives the results:
Success : True
ResultItemsCount : 0
ResultItemsSize : 0 B (0 bytes)
If I change "received" to "sent" in the filter, it also returns the same.
If I run the command below, it produces a PST file with ONLY the two emails in it.
New-MailboxExportRequest -Mailbox <mailbox> -ContentFilter {(received -ge '01/01/2016') -and (received -le '12/31/2018')} -FilePath "UNC-path\export.pst" -BadItemLimit 10
If I change "received" to "sent" in the filter, it also produces a PST file with the same two emails in it.
This means that the filter does work when exporting using either -received or -sent in the search filter.
However, for some reason it does not work when deleting.
Regards,
Here is a summary of this thread:
After running command below, there still exists two emails:
search-mailbox -identity <identity> -searchquery {(received -ge '01/01/2016') -and (received -le '12/31/2018')} -deletecontent -force
Then you said:
Based on this one, I guess those two emails are sent rather than received. Because received email should have Internet headers.
After that, you reply to us, there exist 5 emails when check with "sent":
So, I suggest you use command to export them to another mailbox to check whether those two emails are contained in them.
But, you said this one (This is what I'm suspicious of):
One thing that also needs to pay attention to, the search-mailbox is using UTC time, if those emails are sent/received the morning of 01/01/2016, it may not be contained in this filter.
If this phenomenon only occurs on those two emails, I would suggest delete them manually directly.
Hello GeorgesCarraha
I would recommend to check the next official article: https://learn.microsoft.com/en-us/exchange/troubleshoot/calendars/cannot-remove-items
Also check for a potential corruption: https://learn.microsoft.com/en-us/previous-versions/tn-archive/aa996773(v=exchg.65)?redirectedfrom=MSDN
and
In case the messages are related to large files:
https://social.technet.microsoft.com/Forums/en-US/b0107b72-13c7-412d-937e-a35194480226/unable-to-delete-large-messages?forum=exchangesvradminlegacy
------------------------------------------------------------------------------------------------------------------------------------
--If the reply is helpful, please Upvote and Accept as answer--
Hi,
The first article appears to apply to Exchange online. We are working on an on-premises Exchange server.
The third article does not apply because the messages are not large.
The second article may apply but doubt it. To check we will need to bring down the mail server for a while to do an integrity check.
One thing we found out is that the internet headers section for both emails are blank.
Maybe that is why the -searchquery filter in the powershell command below does not find anything:
search-mailbox -identity <identity> -searchquery {(received -ge '01/01/2016') -and (received -le '
12/31/2018')} -EstimateResultOnly
But how would that explain the -ContentFilter filter in the powershell command below exporting the two emails:
New-MailboxExportRequest -Mailbox <nailbox> -ContentFilter {(received -ge '01/01/2016') -and (received -le '12/31/2018')} -FilePath "UNC-path\export.pst"
I find this so strange.
Regards,
I inspected those two specific emails. When I open the properties, I see that the internet headers section is blank.
and that would make sense if they were in the sent items... no headers for a sent item.
Hi,
You are correct. I should have known better.
Regards,