I need to delete all messages in a particular Exchange user mailbox that were sent from a particular email address. I've managed to get close, but before I run the New-ComplianceSearchAction -purge, I want to confirm the actual results of the original New-ComplianceSearch command are correct. I don't want to delete the wrong messages!
I've issued these commands, and the search has completed:
New-ComplianceSearch -Name 'from-user-2' -ContentMatchQuery 'from:[email protected]' -ExchangeLocation [email protected]
Start-ComplianceSearch -Identity from-user-2
New-ComplianceSearchAction -SearchName "from-user-2" -Report
$results = Get-ComplianceSearchAction -Identity "from-user-2_ReportsOnly" | Select Results
$results.Results | Out-File C:\Users\xxx\OneDrive\Documents\from-user-2.txt
However, when I open the text file, it contains only one line:
Container url: https://cgfyediscnam.blob.core.windows.net/XXXXXXXXXXX; SAS token: <Specify -IncludeCredential parameter to show the SAS token>; Scenario: GenerateReportsOnly; Scope: IndexedItemsOnly; Scope details: AllUnindexed; Max unindexed size: 0; File type exclusions for unindexed: <null>; Total sources: 2; Include SharePoint versions: False; Enable dedupe: False; Reference action: "<null>"; Region: ; Started sources: 2; Succeeded sources: 2; Failed sources: 0; Total estimated bytes: 25,574,406,571; Total estimated items: 398,915; Total transferred bytes: 1,934,417,532; Total transferred items: 9,000; Progress: 2.26%; Completed time: ; Duration: ; Export status: Started
This is a summary (and it appears there are way too many results). Is there a way to get a list of all the matching emails (From, To, Subject, Date)? I know I can export a PST, but it's a lot of data and I'd rather avoid having a PST containing the full emails stored on my local drive.
Thank you!