Exchange 2010, 2013, 2016 - Delete virus email from mailboxes using Search-Mailbox

http://markgossa.blogspot.ca/2015/10/exchange-20102013-delete-virus-email.html

Occasionally but hopefully not too often you may get a virus that bypasses your spam filters and ends up in end users' mailboxes. In this post, I'll demonstrate how to delete the email from users' mailboxes in one quick and easy command which you can have on hand to run quickly.

First, ensure you have the correct permissions:

1. Log into the Exchange Admin Center using an account that is a member of the Organization Management AD Group
2. Click on Permissions
3. Double click on Discovery Management and add your user account as a member
4. Open a new Exchange Management Shell

To delete the email from all users' mailboxes:

Run the below command on a single line:

Get-Mailbox -ResultSize Unlimited | Search-Mailbox -SearchQuery from:sales@sales.com,subject:invoice -DeleteContent -Force

Above, you can see a report where it shows that one email was deleted from the Administrator mailbox (ResultItemCount: 1). 

To delete an email from all mailboxes and copy the email to the Spam mailbox

Get-Mailbox -ResultSize unlimited | Search-Mailbox -SearchQuery from:sales@sales.com,subject:invoice -TargetMailbox Spam -TargetFolder DeletedMessages -DeleteContent

To delete an email according to the attachment file name

Get-Mailbox -ResultSize unlimited | Search-Mailbox -SearchQuery attachment:document_826321_pdf.zip -DeleteContent

Reset ILO4 licence

Download the latest cpqlocfg.exe from:
http://h20564.www2.hpe.com/hpsc/swd/public/detail?swItemId=MTX_e9770d99a87541c39647f729f0

Create an xml file called license_deactivate.txt:

<RIBCL VERSION="2.0">

<LOGIN USER_LOGIN="administrator" PASSWORD="password">

<RIB_INFO MODE="write">

<LICENSE>

<DEACTIVATE/>

</LICENSE>

</RIB_INFO>

</LOGIN>

</RIBCL>

Run the following command:

cpqlocfg.exe -s <ILO-IP> -f license_deactivate.txt -u administrator -p password

Submit Certificate Request to MS Enterprise CA with a template

certreq -submit -attrib "certificatetemplate:WebServer" msm720.csr
certreq -submit -attrib "certificatetemplate:SubCA" SubCA.csr