top of page

Remove Spam Email from everyone's mailbox - Powershell

A gui based script that allows you to search for an email subject line on all user mailboxes, show the result count, and allow removal with a single click. Script defaults to emails from the last 2 days. This script is not responsive so it will act like its frozen until results are found. Run in powershell ISE for best results.

Add-Type -AssemblyName PresentationCore, PresentationFramework

$Xaml = @"

<Window xmlns="" Width="800" Height="400" Title="Remove Emails">


<TextBlock HorizontalAlignment="Left" VerticalAlignment="Top" TextWrapping="Wrap" Text="Type in the Subject line of the emails to remove" Margin="50,80,0,0" FontSize="14" FontWeight="Bold"/>

<TextBox HorizontalAlignment="Left" VerticalAlignment="Top" Height="30" Width="515" TextWrapping="Wrap" Margin="50,113,0,0" Name="subjectText"/>

<Button Content="Search" HorizontalAlignment="Left" VerticalAlignment="Top" Width="75" Margin="610,120,0,0" Name="searchButton" IsEnabled="False"/>

<TextBlock HorizontalAlignment="Left" VerticalAlignment="Top" TextWrapping="Wrap" Text="Emails Found" Margin="50,225,0,0"/>

<TextBox HorizontalAlignment="Left" VerticalAlignment="Top" Height="30" Width="25" TextWrapping="Wrap" Margin="150,220,0,0" Name="foundEmails" IsEnabled="False"/>

<Button Content="Remove" HorizontalAlignment="Left" VerticalAlignment="Top" Width="75" Margin="220,225,0,0" Name="removeButton" IsEnabled="False"/>

<TextBlock HorizontalAlignment="Left" VerticalAlignment="Top" TextWrapping="Wrap" Text="Status" Margin="50,175,0,0"/>

<TextBlock HorizontalAlignment="Left" VerticalAlignment="Top" TextWrapping="Wrap" Text="Waiting" Margin="125,173,0,0" Name="statusText" Foreground="#4a90e2" FontSize="16" FontWeight="Bold"/>

<Button Content="Connect" HorizontalAlignment="Left" VerticalAlignment="Top" Width="75" Margin="50,18,0,0" Name="connectButton"/>

<ProgressBar HorizontalAlignment="Left" Height="37" VerticalAlignment="Top" Width="608" Margin="50,280,0,0" Name="proBar"/>



$todayis = get-date -UFormat "%m%d"

$nameofphish = "phishing"+$todayis

$date= (get-date).AddDays(-1)

$date = $date.ToShortDateString()

$date = [scriptblock]::create($date)

function connectclicked {

# Check if there is a active EXO sessions

Connect-IPPSSession -ConnectionUri

$searchButton.IsEnabled = $true

$connectButton.Content = "Connected"

$connectButton.IsEnabled = $false

$statusText.Text = "Ready"


function findemails {

$statusText.Text = "Searching"

$subjectline = "'"+$subjectText.text+"'"

New-ComplianceSearch -Name $nameofphish -ExchangeLocation All -ContentMatchQuery "$subjectline AND received>=$date"

Start-ComplianceSearch -Identity $nameofphish



function valuestopass {

$searchstatus = Get-ComplianceSearch -Identity $nameofphish | select status, items

$statusText.Text = "Searching"

while ($searchstatus.status -ne "Completed"){

$statusText.Text = "Searching"

start-sleep -Milliseconds 20

$searchstatus = Get-ComplianceSearch -Identity $nameofphish | select status, items



function deleteitems {

New-ComplianceSearchAction -SearchName $nameofphish -Purge -PurgeType SoftDelete


$Window = [Windows.Markup.XamlReader]::Parse($Xaml)

[xml]$xml = $Xaml

$xml.SelectNodes("//*[@Name]") | ForEach-Object { Set-Variable -Name $_.Name -Value $Window.FindName($_.Name) }


$connectButton.IsEnabled = $false

connectclicked $this $_})


findemails $this $_

$searchstatus = Get-ComplianceSearch -Identity $nameofphish | select status, items

$foundEmails.text = $searchstatus.Items

$removeButton.IsEnabled = $true

$statusText.Text = "Done"})

$removeButton.Add_Click({deleteitems $this $_

Get-ComplianceSearch -Identity $nameofphish | Remove-ComplianceSearch})

#installs exchangeonlinemanagement if its not installed

if (Get-Module -ListAvailable -Name exchangeonlinemanagement) {

Write-Host "Exchange module already installed"


else {

try {

Install-Module -Name exchangeonlinemanagement -AllowClobber -Confirm:$False -Force


catch [Exception] {





#removes pssessions on close


Get-PSSession | Remove-PSSession



Power in Numbers




Project Gallery

bottom of page