Skip to content

How to delete all EV shortcuts from a mailbox

August 12, 2013

You may need to delete all Enterprise Vault shortcuts from Exchange mailboxes. I’m seeing this a lot nowadays as more organizations migrate to online services. However, there are other legitimate reasons why you might want to purge old stubs and this post details various methods of doing so. If you’re doing this as part of a phased migration then consider implementing Virtual Vault if you haven’t done so already.

If you want to delete EV shortcuts using Exchange Management Shell and you know what you’re doing then here’s a quick PowerShell command reference to save you reading any further:

Search-Mailbox -Identity {Identity} -SearchQuery "IPM.NOTE.EnterpriseVault" -EstimateResultOnly |fl DisplayName,ResultItemsCount
Search-Mailbox -Identity {Identity} -SearchQuery "IPM.NOTE.EnterpriseVault" -DeleteContent
Import-Csv {import_csv_filename} | ForEach-Object { Search-Mailbox -Identity $_.UserName -SearchQuery "IPM.NOTE.EnterpriseVault" -EstimateResultOnly |fl DisplayName,ResultItemsCount }
Import-Csv {import_csv_filename} | ForEach-Object { Search-Mailbox -Identity $_.UserName -SearchQuery "IPM.NOTE.EnterpriseVault" -DeleteContent }

Read on for further information…

1. Implement an EV shortcut deletion policy

This is far and away the preferred method of shortcut deletion. It’s easy to implement, completely automated and *usually* very reliable. You need to implement this in advance though and the mailboxes you want to delete shortcuts from must be active targets in EV. It therefore requires a working EV environment! Simply modify the Mailbox Policy that applies to the relevant mailboxes and configure Shortcut Deletion:


To apply the policy to a subset of users rather than globally, you can configure a new Exchange Mailbox Policy and Provisioning Group in EV.

UPDATE – I’d also recommend disabling dynamic shortcuts on the mailbox policy, especially if you’re provisioning a dedicated mailbox policy for shortcut deletion. Enterprise Vault shortcut processing will not delete ‘Moved Shortcuts’, so you may find the vast majority of shortcuts are successfully purged but a handful remain. Shortcuts in Outlook folders linked to a shared source (folders identified by a two-headed blue arrow in the Outlook client) will also not be processed. Disable dynamic shortcuts by unchecking the option ‘Update archive location for items moved in the mailbox’ under either the ‘Existing Items’ tab or ‘Moved Items’ tab, depending on which version of Enterprise Vault you’re running.

If you’re migrating mailboxes to online services then implement these changes in advance and allow sufficient time for shortcut processing to complete. You can manually force shortcut processing at any time by performing Run Now on the relevant mailbox archiving task and choosing either Archiving and Shortcut processing or Shortcut processing:


2. Export archives to their original mailboxes

You can export archives back to their original mailbox using the VAC. In doing so, all archived items restored to a folder will replace the associated shortcuts in that folder:


If you have dynamic shortcuts enabled and the mailbox is still an active target then this option should provide good results. Dynamic shortcuts (the process by which EV moves items within an archive when a user moves the corresponding shortcuts within their mailbox) are only updated during a Shortcut Processing task (part of the Exchange Mailbox Archiving task). This means that recently moved shortcuts won’t be replaced in the users archive if an archive task hasn’t run since the shortcuts were moved:


You probably want to disable the user for archiving when exporting the archive back to their mailbox. Failure to do so will result in all eligible items getting archived again during the next archive run.

You need to ensure that importing data back into your on-premise Exchange databases won’t push mailboxes beyond their storage limits and also confirm your mailbox databases and storage can cope with the additional data.

This may be a valid option if you’re decommissioning Enterprise Vault or exporting small archives but it’s unlikely that you’ll consider it otherwise.

3. Delete shortcuts via PowerShell

Update for Exchange 2013This process does not work with Exchange 2013. Unlike Exchange 2007 and 2010, the Search-Mailbox cmdlet in Exchange 2013 cannot natively search the Message Class attribute. Third-party scripts are available, but haven’t been tested.

In Exchange 2003 you could use MRM (Mailbox Management Policies) to purge items from mailboxes. It was easy to implement using Exchange System Manager and Enterprise Vault customers could successfully search and delete based on EV-specific message classes. So a query of ‘message class contains enterprisevault’ would return only EV items (stubs) from mailboxes.

Things got a little more complicated in Exchange 2007 and above. However it’s easy to search and delete from mailboxes using PowerShell (EMS). Just be aware that, unlike MRM in Exchange 2003, you can’t natively build searches based specifically on message class (although third-party scripts are available that allow this). Any searches you perform will search the *entire* email including the message class field. You need to build your search query with this in mind.

A search query of ‘enterprisevault’ for example, although perfect for MRM, isn’t specific enough for EMS PowerShell searches and will return any email containing enterprisevault in the subject/body/attachments in addition to all EV stubs.

You must have necessary permissions to use the Search-Mailbox cmdlet. Typically this is assigned through the Discovery Management roles based admin group.

Enterprise Vault mailbox items include the following message classes:

  • IPM.Note.EnterpriseVault.Shortcut
  • IPM.Note.EnterpriseVault.PendingArchive
  • IPM.Note.EnterpriseVault.Shortcut.DeleteMe
  • IPM.Note.EnterpriseVault.Shortcut.RestoreMe
  • IPM.Note.EnterpriseVault.PendingArchive.ArchiveMe

I’d therefore suggest a search query of ‘IPM.Note.EnterpriseVault’. Searches are not case-sensitive.

And so on to the commands…

This command searches a specific mailbox for anything containing “IPM.NOTE.EnterpriseVault” and reports on all results:

Search-Mailbox -Identity {Identity} -SearchQuery "IPM.NOTE.EnterpriseVault" -EstimateResultOnly


The Identity parameter accepts the following values:

  • Alias
  • Canonical DN
  • Display Name
  • Distinguished Name (DN)
  • Domain\Account
  • GUID
  • Immutable ID
  • Legacy Exchange DN
  • SMTP Address
  • User Principal Name

This command searches a specific mailbox for anything containing “IPM.NOTE.EnterpriseVault” and reports on number of items found:

Search-Mailbox -Identity {Identity} -SearchQuery "IPM.NOTE.EnterpriseVault" -EstimateResultOnly |fl DisplayName,ResultItemsCount


This command searches a specific mailbox for anything containing “IPM.NOTE.EnterpriseVault” and all valid results will be copied to another mailbox. You can then look at the target mailbox and see exactly what would be deleted if you used the -DeleteContent command.

Search-Mailbox -Identity {Identity} -SearchQuery "IPM.NOTE.EnterpriseVault" -TargetMailbox {Identity_Target_Mailbox} -TargetFolder {Target_Folder}


The TargetFolder is created automatically in the root of the target mailbox.

This command searches a specific mailbox for anything containing “IPM.NOTE.EnterpriseVault” and *deletes* all valid results:

Search-Mailbox -Identity {Identity} -SearchQuery "IPM.NOTE.EnterpriseVault" -DeleteContent


You can process multiple users at once by importing a list of mailboxes from CSV file. Create a CSV file containing a header in row 1 (I’ve used a header called UserName in this example) and then a list of mailbox identities on all subsequent lines (one per line):



You can then run exactly the same commands as above but encapsulate the commands as follows:

Import-Csv {import_csv_filename} | ForEach-Object { Search-Mailbox -Identity $_.UserName -SearchQuery "IPM.NOTE.EnterpriseVault" -EstimateResultOnly }
Import-Csv {import_csv_filename} | ForEach-Object { Search-Mailbox -Identity $_.UserName -SearchQuery "IPM.NOTE.EnterpriseVault" -EstimateResultOnly |fl DisplayName,ResultItemsCount }
Import-Csv {import_csv_filename} | ForEach-Object { Search-Mailbox -Identity $_.UserName -SearchQuery "IPM.NOTE.EnterpriseVault" -DeleteContent }

For example:

Import-Csv C:\Temp\EvStubs.csv | ForEach-Object { Search-Mailbox -Identity $_.UserName -SearchQuery "IPM.NOTE.EnterpriseVault" -EstimateResultOnly |fl DisplayName,ResultItemsCount }


4. Delete items using Microsoft Outlook

This method allows all users to manually find and delete EV shortcuts within their mailbox. It’s fine for testing purposes or a small amount of clean-up, but it’s not something you’d typically expect end-users to perform.

However, if needs must then any user can perform an Advanced Find using Outlook. Choose Message Class from All Mail Fields and add the query ‘Message Class contains EnterpriseVault’:


From the search results you can select all and delete.


  1. Cisse permalink

    Can you deliver me the Search-Mailbox.ps1 script please? Great tutorial anyway!

  2. Search-Mailbox is build in Exchange 2010 SP1 command-let. For older: export-mailbox.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: