Is there a powershell script or command that will search a mailbox database for a specific mail attachment? We had a virus that was contained an executableinside a zip file and was wondering if we could scan and delete the attachment or the email from all users that had recieved the message.

Hi, If running under coexistence then you can use ExMerge to delete mails from Exchange 2003 mailboxes. Exchange 2003: You can use ExMerge utility to delete the messages from all the mailboxes by specifying attachment name. Reference: How do I use EXMERGE to delete specific messages from Exchange 2000/2003 mailboxes? http://www.petri.co.il/delete_messages_from_mailboxes_by_using_exmerge.htm Check step-11 in this article to specify attachment name. Exchange 2007: You can use Export-Mailbox with -AttachmentFilenames and DeleteContent switches to delete messages from all the mailboxes. Reference: Exchange Server 2007 Export Mailbox task http://msexchangeteam.com/archive/2006/11/28/431669.aspx

Thanks for the reply. That is exactly what I was looking for. Does the exchange 2007 export-mailbox commandcreate a folder for"all users" mailboxs when transfered to the administrators account or only those with the files that are found? Is there a way to also search by attachment size? Say I have an attachment named Virus.zip and the file is 32kb. In this case I only want to delete the zip attachment if the file size is 32kb. Is there also a way to search for multiple attachments in a single script? Would I type -attachmentfilename 'virus.exe' and 'virus_two.zip'

Hello, It basically creates a folder name Recovered Data - <source mailbox alias> - <date time stamp> into target mailbox. You can also export intoPST file instead of exporting it into Admin mailbox with PSTFolderPath switch. You can find more example and detailed information about pre-requisites of Export-Mailbox in below article. How to Export Mailbox Data http://technet.microsoft.com/en-us/library/bb266964(EXCHG.80).aspx Export-Mailbox http://technet.microsoft.com/en-us/library/aa998579(EXCHG.80).aspx I think there isnt any option to search with the size of attachment. You can use wildcard search in attachment file name like virus*.* in the specified switch but I have doubt on passing multiple file name.