Content Search Syntax

Question

Hi All

I want to delete spam emails from users mailbox.
Please validate the below syntax if its correct, i have 20 users who have received the spam email and i need to delete it, experts guide me.

syntax01--For All user
$Search=New-ComplianceSearch -Name "Remove Phishing Message" -ExchangeLocation All -ContentMatchQuery '(Received:09/01/2020 00:00..09/01/2020 23:59) AND (Subject:"Action required") AND (from:"someuser@ext.com")'
Start-ComplianceSearch -Identity $Search.Identity
New-ComplianceSearchAction -SearchName "Remove Phishing Message" -Purge -PurgeType SoftDelete -force

Syntax02--For Single user
$Search=New-ComplianceSearch -Name "RemoveMessage_John" -ExchangeLocation John@Company portal .com -ContentMatchQuery '(Received:09/01/2020 00:00..09/01/2020 23:59) AND (Subject:"Action required") AND (from:"someuser@ext.com")'
Start-ComplianceSearch "RemoveMessage_John"
New-ComplianceSearchAction -SearchName "RemoveMessage_John" -Purge -PurgeType SoftDelete -force

Syntax03-If i have 20 users in a csv file how do i delte the emails

Answer 1

syntax01: It's OK.

syntax02: It seems Start-ComplianceSearch "RemoveMessage_John" will not be reported as error but in my test it's not starting the search, use Start-ComplianceSearch -Identity "name" instead.

syntax03: An easy method is to manually add them to a group(GroupA) in ECP and run syntax1 with "-Exchangelocation GroupA", which should work for 20 users.
Or you write a script to add group members, for example: Import-CSV FileName.csv | ForEach {Add-DistributionGroupMember -Identity "GroupName" -Member $_.Name}

---

If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.