Delete Single Email from sender to All Users in Exchange 2010

Question

Dear All,
I have received one virus from 163.com. i want to delete all mails coming from 163.com to all users mailbox. the subject and attachment words are common so we can not delete it by attachment name or subject name.
pls help me to delete by domain.
Sunil
SUNIL PATEL SYSTEM ADMINISTRATOR

Answer 1

Before I do a search and remove like this, I like to run a message track first, to see how widespread the issue is. If it's only a few users who received the message, I would just run search-mailbox against their identity and remove the email. Here's an
example of the message track I would run:
Get-TransportServer | Invoke-Command {Get-MessageTrackingLog -Sender "[email protected]" -MessageSubject "Important information about your account" -Start "09/08/2014 00:01:00 AM" -End "09/11/2014 10:00:00 AM" | Select
Sender,{$_.Recipients},{$_.RecipientStatus},MessageSubject,TimeStamp, EventId, Source, SourceContext,MessageId,InternalMessageId,ClientIP,ClientHostName,ServerIP,ServerHostName,ConnectorId,TotalBytes,RecipientCount,RelatedRecipientAddress,Reference,ReturnPath,MessageInfo
| Export-Csv E:\temp\MessageTrackingLog-ShadyBiz.csv -NoTypeInformation}
Then, if it's a few users, I get their identity info from the spreadsheet and run this on each:
Search-Mailbox -Identity michaeld -SearchQuery subject:"Important information about your account", Sent:'09/08/2014..09/11/2014', from:'[email protected]' -TargetMailbox "ex2010security"
-TargetFolder "ShadyBiz" -Loglevel Full -DeleteContent -Force -Confirm:$false
This would put the found messages into a folder called ShadyBiz in a mailbox I designate, then delete the content from the user's mailbox (you could then use the info in the folder for reporting purposes
and delete it once you are done).
If you find you have to run this against all the mailboxes in your company, you might want to try this approach:
$mbs=Get-Mailbox –ResultSize Unlimited | Where {($_.PrimarySMTPAddress –like ‘*yourcompany.com*’) –and ($_.RecipientTypeDetails –eq ‘UserMailbox’)}
ForEach ($mb in $mbs) {Search-Mailbox -Identity $mb.identity -SearchQuery subject:"Important information about your account", Sent:'09/08/2014..09/11/2014', from:'[email protected]' -TargetMailbox
"ex2010security" -TargetFolder "ShadyBiz" -Loglevel Full -DeleteContent -Force -Confirm:$false}