I am testing the following scenario

I want to delete a specific email message from a user mailbox and from exchange Journal. I have done the following steps but not sure if I deleted the message completely 

1. logged into the OWAl/ecp and used the discovery mailbox search

2. the search results are copied to the discovery mailbox, I found the message and deleted the message from the results and from the deleted the items of discovery mailbox.

3. I did the search again on the same user and found the same message again which I previously deleted, so this time I ran the following command in exchange shell which deleted the message

Search-Mailbox -Identity "<user>" -SearchQuery 'Subject:"<subject_title>"' -DeleteContent

 

4. used the discovery mailbox search again just to confirm and found the message again on the search results

5 ran the above shell command again and this the deleted message showed 0KB which means that it was already deleted.

My question is that by running the above shell command does it delete from user mailbox and from Journal as well? am I following the right steps to deleted a specific message? what is the recommended  way of deleting when exchange is setup to Journal all messages in cached exchange mode.

Thanks.

you can use search-mailbox cmdlet to delete emails from user mailbox and journal mailbox. you have to give journal mailbox name to search and delete.

thanks for the response, what will be the exact command for removing from Journal mailbox?

http://serverfault.com/questions/622438/exchange-2010-search-mailbox-to-delete-exchange-journal-emails

please check this link.

Hi Nawab,

You can use the Search-Mailbox cmdlet to search and delete messages from a mailbox.

Hence you need to know the exact mailboxes containing the emails you want to delete.

If the mailbox from which you want to delete messages has single item recovery enabled or Litigation Hold enabled, then the deletion will not be permanent or might not work at all until you remove them.

Use Mailbox Search to Delete Messages

*You used Multi-Mailbox search or  Discovery Search (Requires you special permission RBAC, even to full admins) to find the emails then decide upon deleting it.

This should already list email in journal mailboxes within exchange as well. Just take note of all the mailboxes having the email, disable single item recovery or hold on those mailboxes and delete it.

Create a Discovery Search

Using Multi-Mailbox Search, you can search a large volume of e-mail messages stored in mailboxes across one or more Exchange 2010 servers, and possibly in different locations.

NOTE:-You cant search content of a disconnected mailbox.

If the mailbox has an enterprise CAL, you can use the Multi-Mailbox Search feature in the Exchange Control Panel (ECP) or the New-MailboxSearch cmdlet in the Shell. These features also allow you to search multiple mailboxes simultaneously.

You can also use the Search-Mailbox cmdlet in the Shell to search for and recover missing items. If the mailbox has a standard CAL, this is the only method you can use. If you use this cmdlet, you can search only one mailbox at a time.