top of page

Remove Spam Email from everyone's mailbox - Powershell

A gui based script that allows you to search for an email subject line on all user mailboxes, show the result count, and allow removal with a single click. Script defaults to emails from the last 2 days. This script is not responsive so it will act like its frozen until results are found. Run in powershell ISE for best results.



Add-Type -AssemblyName PresentationCore, PresentationFramework


$Xaml = @"

<Window xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation" Width="800" Height="400" Title="Remove Emails">

<Grid>

<TextBlock HorizontalAlignment="Left" VerticalAlignment="Top" TextWrapping="Wrap" Text="Type in the Subject line of the emails to remove" Margin="50,80,0,0" FontSize="14" FontWeight="Bold"/>

<TextBox HorizontalAlignment="Left" VerticalAlignment="Top" Height="30" Width="515" TextWrapping="Wrap" Margin="50,113,0,0" Name="subjectText"/>

<Button Content="Search" HorizontalAlignment="Left" VerticalAlignment="Top" Width="75" Margin="610,120,0,0" Name="searchButton" IsEnabled="False"/>

<TextBlock HorizontalAlignment="Left" VerticalAlignment="Top" TextWrapping="Wrap" Text="Emails Found" Margin="50,225,0,0"/>

<TextBox HorizontalAlignment="Left" VerticalAlignment="Top" Height="30" Width="25" TextWrapping="Wrap" Margin="150,220,0,0" Name="foundEmails" IsEnabled="False"/>

<Button Content="Remove" HorizontalAlignment="Left" VerticalAlignment="Top" Width="75" Margin="220,225,0,0" Name="removeButton" IsEnabled="False"/>

<TextBlock HorizontalAlignment="Left" VerticalAlignment="Top" TextWrapping="Wrap" Text="Status" Margin="50,175,0,0"/>

<TextBlock HorizontalAlignment="Left" VerticalAlignment="Top" TextWrapping="Wrap" Text="Waiting" Margin="125,173,0,0" Name="statusText" Foreground="#4a90e2" FontSize="16" FontWeight="Bold"/>

<Button Content="Connect" HorizontalAlignment="Left" VerticalAlignment="Top" Width="75" Margin="50,18,0,0" Name="connectButton"/>

<ProgressBar HorizontalAlignment="Left" Height="37" VerticalAlignment="Top" Width="608" Margin="50,280,0,0" Name="proBar"/>

</Grid></Window>

"@


$todayis = get-date -UFormat "%m%d"

$nameofphish = "phishing"+$todayis

$date= (get-date).AddDays(-1)

$date = $date.ToShortDateString()

$date = [scriptblock]::create($date)



function connectclicked {

# Check if there is a active EXO sessions

Connect-IPPSSession -ConnectionUri https://ps.compliance.protection.outlook.com/powershell-liveid

$searchButton.IsEnabled = $true

$connectButton.Content = "Connected"

$connectButton.IsEnabled = $false

$statusText.Text = "Ready"

}


function findemails {

$statusText.Text = "Searching"

$subjectline = "'"+$subjectText.text+"'"

New-ComplianceSearch -Name $nameofphish -ExchangeLocation All -ContentMatchQuery "$subjectline AND received>=$date"

Start-ComplianceSearch -Identity $nameofphish

valuestopass

}


function valuestopass {

$searchstatus = Get-ComplianceSearch -Identity $nameofphish | select status, items

$statusText.Text = "Searching"

while ($searchstatus.status -ne "Completed"){

$statusText.Text = "Searching"

start-sleep -Milliseconds 20

$searchstatus = Get-ComplianceSearch -Identity $nameofphish | select status, items

}

}


function deleteitems {

New-ComplianceSearchAction -SearchName $nameofphish -Purge -PurgeType SoftDelete

}




$Window = [Windows.Markup.XamlReader]::Parse($Xaml)


[xml]$xml = $Xaml


$xml.SelectNodes("//*[@Name]") | ForEach-Object { Set-Variable -Name $_.Name -Value $Window.FindName($_.Name) }



$connectButton.Add_Click({

$connectButton.IsEnabled = $false

connectclicked $this $_})

$searchButton.Add_Click({

findemails $this $_

$searchstatus = Get-ComplianceSearch -Identity $nameofphish | select status, items

$foundEmails.text = $searchstatus.Items

$removeButton.IsEnabled = $true

$statusText.Text = "Done"})

$removeButton.Add_Click({deleteitems $this $_

Get-ComplianceSearch -Identity $nameofphish | Remove-ComplianceSearch})



#installs exchangeonlinemanagement if its not installed

if (Get-Module -ListAvailable -Name exchangeonlinemanagement) {

Write-Host "Exchange module already installed"

}

else {

try {

Install-Module -Name exchangeonlinemanagement -AllowClobber -Confirm:$False -Force

}

catch [Exception] {

$_.message

exit

}

}


#removes pssessions on close

$Window.Add_Closing({

Get-PSSession | Remove-PSSession

})


$Window.ShowDialog()

Power in Numbers

Programs

Locations

Volunteers

Project Gallery

bottom of page