Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Every once in a while a spam message makes it into the network. The spam message might go to one or more recipients. When sent to multiple recipients, the emails are addressed only to individuals (vs multiple addresses in the "To"field)... so it's not necessarily "one" email, but many identical messages.

Currently, we deal with this by having the intern sent out a company-wide message saying not to click on the link in the email, don't wire any money to the stranded prince, etc.

Is there a way to flag the message as spam (after the fact), so Outlook automatically moves it to people's Junk folders?

Edit: To be clear, I am really more interested in getting rid of the company-wide warning message after a user reports a spam message

share|improve this question
It would be possible for a spam filter to look at the e-mails that have already been delivered, but I've never seen such a thing. The only thing I've seen that looks at delivered messages is anti-virus. You'd probably be much better off just tightening your spam filtering up front. – Chris S Feb 26 '13 at 15:09
ah. You are saying the filters run on receipt, correct? But, I can recall messages, etc in Outlook. – David J Feb 26 '13 at 15:31
up vote 0 down vote accepted

If you don't mind just deleting the message entirely, you could use the Search-Mailbox powershell command. And just to be safe you can copy the message to another mailbox in case you need to put them back or whatever.

Replace both of "yourmailbox" with the alias of the mailbox where you want the backup copies to go.

Also, using the Advanced Query Syntax detailed at Microsoft’s website, write your filter. Some examples:

  • Double quotes means match the subject exactly:

    'subject:"Your software order."'

  • Parenthesis means match the words "UPS" and "tracking" anywhere in the subject. The rest of the filter requires that the message have an attachment:

    'subject:(UPS tracking) has attachment:true'

  • Matches emails sent from either email address:

    ' OR'

Replace "filter" with your filter.

get-mailbox -filter {alias -ne "yourmailbox"} -resultsize unlimited |
    Search-Mailbox -searchquery 'filter' -deletecontent
        -targetmailbox yourmailbox -targetfolder StupidSpam
        -searchdumpster -force -loglevel full

Once that is done, all the message will be gone from your user's mailboxes!

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.