If you are a Google Suite school, you have no doubt had an instance where someone (staff or student) sent an email to everyone in the system and you’ve been asked to delete it from everyone’s mailbox. Back when we had Microsoft Exchange, it was a simple task to delete the offending message and yank it from everyone’s mailboxes even if they had read it. Working in Google’s ecosystem makes things slightly more difficult but it can still be done.
First, you need to have Vault enabled for your users.
Now, we will create a retention rule to filter out just the messages we want to delete. In the “Conditions” section, you can narrow your search by sent date, and terms. The terms search will allow you to search by message id, username, and various other fields. (Check this link for more search operators. https://support.google.com/vault/answer/2474474)
In the graphic below, I have created a search that will pull e-mails with a sent date of November 3, 2016 with a subject of “yoursubjectgoeshere” and from firstname.lastname@example.org.
Change the duration for your retention rule to be 1 day from when the message was sent, and “Expunge all messages which includes messages that are in users’ inboxes and messages that have already been deleted” to match the graphic below.
Before you click Continue, make sure to preview your results. After you click continue you will get a warning about deleting messages from mailboxes and the fact that they will be gone forever.
Google Support advised me that it could take up to 48 hours to remove all messages, but will likely be much faster. They did mention that there is another way to do this task, but it involves third party solutions and using the API interface. By the time we got it up and running, the Vault retention rule likely would have removed the messages anyway.
Here is Google’s link to creating custom Vault retention rules.