Powershell - Delete email from all inboxes

[newpersn]

So... following on my other topic.. 

 

I'm trying to remove this email from everyones inbox and having issues with powershell commands. 

 

Quote

New-ComplianceSearchAction: |Microsoft.Exchange.Management.Tasks.ComplianceJobTaskException|Unable to execute the task. Reason: The search
"Name" is still running or it didn't return any results. Please wait until the search finishes or edit the
query and run the search again.

 

I've done the search using the website of exchange and that looks to be finished. But when i go to run the delete command like above i get this error. 

 

What am i doing wrong here?

 

[andy_b]

Is that the exact error, or have you redacted it?  Otherwise that looks like it is looking for a search called "Name"?

 

Ps If you have access to Explorer (https://security.microsoft.com/threatexplorerv3) I find that can be quicker to mass delete using the "take action" function.

Edited August 11 by andy_b

[newpersn]

I redacted it - Had the same of the sender in. 

 

I will see if i have access to Explorer

 

[newpersn]

Dont have licence for Threat Explorer

[mikes]

It's a pain I had to do a new Compliance-Search - I'm sure there's a GUI for it as well as we are just A1 and have access - in the MS security portal (purview?)  under Ediscovery

 

I did a Compliance Search for the subject and also put a date range in to speed it up a lil.

Once the Search was done I could then run a powershell script against Exchange Online to delete the mail based on the compliance search for all mailboxes.

Of course check the results of the compliance search to make sure it hasn't returned all mails.

 

It's not a very intuitive process at all and I was having issues with things randomly not working, but this is typical Microsoft. I remember there was a bug the same as yours with results saying they hadn't finished when they had. It's a bug but I don't remember any more sorry it's been months since I last did one, every time it crops up I have to google how to do it to find out MS have changed it slightly !

Edited August 11 by mikes

[andy_b]

Are you following the "new" instructions:

 

https://learn.microsoft.com/en-us/purview/edisc-search-mailbox-data#step-1-connect-to-security--compliance-powershell

[newpersn]

Yep - Following the new instructions.

 

I might do a new search from powershell 

[robintech]

Sometimes you have to start the search in PowerShell even though you started it in Purview, should show you the status of running searches, or it sometimes only works if the search is created in PowerShell like you said

 

I just pasted this from a template I use but Get-ComplianceSearch might help

New-ComplianceSearch -Name "deletetheseemails" -ExchangeLocation All -ContentMatchQuery "(From:[email protected]) AND (Date>2026-07-13) AND (Recipients:[email protected])"

Get-ComplianceSearch -Identity "deletetheseemails" | FL name,items,size,jobprogress,status

Start-ComplianceSearch deletetheseemails

Get-ComplianceSearch -Identity "deletetheseemails" | FL name,items,size,jobprogress,status

New-ComplianceSearchAction -searchname "deletetheseemails"  -Purge -PurgeType HardDelete

or SoftDelete

Get-ComplianceSearchAction deletetheseemails | fl

and so on

 

 

Edit: if its internal I always tell them to recall it as so much faster and they get a nice automated report of the recall status.

Edited August 11 by robintech

[newpersn]

Thanks all. 

 

Somehow managed to remove the email.