Take it back! Recalling an e-mail message

When a potentially damaging e-mail is sent and you are asked to remove it from the database, you have a few options to get the job done.

An executive at your company accidentally sends a confidential memo to everyone in the entire company. He calls...

you, frantic, demanding that you shut down all mail servers immediately to prevent the message from being delivered (never mind that this isn't how Exchange works).

This scenario is not far fetched -- it happened to someone I know recently. Can you recall the message? Yes and no. I'll explain a couple of techniques that could help you in this situation, depending on the version of Exchange and Outlook that you use.

As you probably know, Outlook 2003 offers a mail recall feature (assuming that it is configured as an Exchange client). However, I think this feature gives a false sense of security because it has limitations.

Go into the Sent Items container and select the message and then choose the Recall This Message command from the message's Action menu. Exchange will then give you the choice of either deleting the message or replacing it with a different message.

This sounds like exactly what the doctor ordered, but there are some serious limitations in recalling messages. For one thing, you can only recall messages that were sent to Exchange recipients. Messages sent to SMTP mailboxes can't be recalled because they do not exist in the Exchange Information Store. Second, you can't recall a message that has already been read. Third, and this is the biggie, the recalled message is not actually removed from the user's inbox. Instead, a second message is sent to the recipient with the word RECALL appended to the subject line. If the recipient opens the recall message, then the offending message will be deleted and a confirmation will be sent to the person who performed the recall. On the other hand, if the recipient opens the original message rather than the recall message, they will see the actual message that was sent by mistake.

The EXMERGE method
The Microsoft web site offers a different mail retrieval technique by which you can use EXMERGE to remove the offending message from the information store. The technique was originally designed for use with Exchange 5.5, but it works with Exchange Server 2000 and 2003 as well. However, for this technique to work, you must be logged in as the Exchange system account. Simply logging in as an Administrator will not give you the required permissions.

EXMERGE isn't included with Exchange 2000 or 2003, but you can download it here After doing so, you must copy the EXMERGE files to the Program Files\exchsrvr\bin folder. Now, double click the EXMERGE.EXE file to launch the EXMERGE program. When EXMERGE opens, click Next to bypass the Welcome screen. The following screen will ask you if you want to perform a one-step procedure or a two step procedure. Select the two-step procedure option and click Next. Now, tell EXMERGE that you want to perform Step 1 and click Next.

At this point, you must enter the name of your Exchange server and then click the Options button. When you do, you will see the Data Selection Criteria properties sheet. Select the User Messages and Folders check box from the properties sheet's Data tab. Now, select the Import Procedures tab and select the Archive Data To Target Store radio button. This will cause all of the selected data to be copied to a PST file and removed from the Information store. If you happen to receive a warning message, click Yes to continue.

Now, select the Message Details tab. This tab will allow you to specify the message subject or the name of an attachment within a message. It is possible that other non-related messages may have the same subject line or attachment name. To avoid removing those messages from the information store, use the Dates tab to input a date range.

Once you are done selecting a date range, click OK followed by Next. EXMERGE will now display a list of all of the mailboxes available on the server. Select the mailboxes that you want to search (or click the Select All button) and click Next. Verify that the appropriate language is selected and click Next. You are now prompted to specify a folder where the PST files should be created. After specifying the folder, click Next twice to complete the operation.

Now, the offending message should have been removed from the mailboxes in question. You can check the ExMerge.log file for confirmation, or just browse a few mailboxes.


Brien M. Posey, MCSE, is a Microsoft Most Valuable Professional for his work with Windows 2000 Server and IIS. Brien has served as the CIO for a nationwide chain of hospitals and was once in charge of IT security for Fort Knox. As a freelance technical writer he has written for Microsoft, CNET, ZDNet, TechTarget, MSD2D, Relevant Technologies and other technology companies. You can visit Brien's personal Web site at http://www.brienposey.com.


Did you find this tip useful? It first appeared in the free SearchExchange.com newsletter, Exchange Adviser. Sign up now so you can receive the Exchange Adviser, which is filled with technical articles, expert advice, news and everything Exchange!


Do you have a useful Exchange tip to share? Submit it to our monthly tip contest and you could win a prize and a spot in our Hall of Fame.

Dig Deeper on Exchange Server setup and troubleshooting