How to Clean Up Exchange Server Logs Using PowerShell to Free Disk Space

Before running any PowerShell scripts, you need to configure the execution policy to allow script execution. By default, Windows servers restrict PowerShell script execution for security reasons.

Open PowerShell as Administrator and run the following command:

Set-ExecutionPolicy RemoteSigned -Force

This allows locally created scripts and signed remote scripts to run. The -Force parameter bypasses confirmation prompts.

Get-ExecutionPolicy

You should see RemoteSigned as the output.

Create a dedicated directory for your cleanup scripts. This keeps your scripts organized and makes scheduling easier.

New-Item -Path "C:\Scripts" -ItemType Directory -Force

Navigate to the scripts directory:

Set-Location "C:\Scripts"

Test-Path "C:\Scripts"

This should return True.

Since Microsoft doesn't provide an official log cleanup script, we'll use the community-maintained SammyKrosoft script from GitHub, which is compatible with Exchange 2013, 2016, and 2019.

Download the script using PowerShell:

Invoke-WebRequest -Uri "https://raw.githubusercontent.com/SammyKrosoft/Clean-Exchange-Log-Files/master/CleanExchangeLogFiles.ps1" -OutFile "C:\Scripts\CleanExchangeLogFiles.ps1"

Alternatively, create your own simplified version. Save this as C:\Scripts\CleanupExchangeLogs.ps1:

# Exchange Log Cleanup Script
param(
    [int]$Days = 7,
    [switch]$DoNotDelete
)

$LogPaths = @(
    "$env:SystemDrive\inetpub\logs\LogFiles",
    "$env:ExchangeInstallPath\Logging",
    "$env:ExchangeInstallPath\Bin\Search\Ceres\Diagnostics\Logs"
)

$CutoffDate = (Get-Date).AddDays(-$Days)
$TotalSize = 0

foreach ($Path in $LogPaths) {
    if (Test-Path $Path) {
        $Files = Get-ChildItem -Path $Path -Recurse -File | Where-Object {$_.LastWriteTime -lt $CutoffDate}
        $PathSize = ($Files | Measure-Object -Property Length -Sum).Sum
        $TotalSize += $PathSize
        
        Write-Host "Found $($Files.Count) files in $Path ($('{0:N2}' -f ($PathSize/1MB)) MB)"
        
        if (-not $DoNotDelete) {
            $Files | Remove-Item -Force -ErrorAction SilentlyContinue
            Write-Host "Deleted files older than $Days days from $Path"
        }
    }
}

Write-Host "Total space that would be freed: $('{0:N2}' -f ($TotalSize/1MB)) MB"

Get-ChildItem "C:\Scripts\*.ps1"

Before actually deleting files, run the script in test mode to see what files would be removed and how much space would be freed.

Run the dry run command:

C:\Scripts\CleanupExchangeLogs.ps1 -Days 7 -DoNotDelete

This will scan for log files older than 7 days without deleting them. You'll see output similar to:

Found 245 files in C:\inetpub\logs\LogFiles (156.23 MB)
Found 89 files in C:\Program Files\Microsoft\Exchange Server\V15\Logging (89.45 MB)
Total space that would be freed: 245.68 MB

Review the output carefully. If you see critical system files or recent logs being targeted, adjust the -Days parameter.

Once you're satisfied with the dry run results, execute the actual cleanup. Start with a shorter retention period to be safe.

Run the cleanup for files older than 7 days:

C:\Scripts\CleanupExchangeLogs.ps1 -Days 7

The script will delete the identified files and show progress. You should see output confirming the deletions:

Deleted files older than 7 days from C:\inetpub\logs\LogFiles
Deleted files older than 7 days from C:\Program Files\Microsoft\Exchange Server\V15\Logging
Total space that would be freed: 245.68 MB

For more aggressive cleanup (use with caution), you can reduce the retention period:

C:\Scripts\CleanupExchangeLogs.ps1 -Days 2

Get-Volume C | Select-Object DriveLetter, SizeRemaining

For automated cleanup, create a dedicated service account with the necessary permissions. This follows security best practices by not using administrator accounts for scheduled tasks.

Create the service account using PowerShell:

$SecurePassword = ConvertTo-SecureString "ComplexPassword123!" -AsPlainText -Force
New-LocalUser -Name "svc-ExchangeCleanup" -Password $SecurePassword -Description "Exchange Log Cleanup Service Account" -PasswordNeverExpires

Add the account to the local "Log on as a service" right and grant permissions to the log directories:

# Grant permissions to log directories
$LogPaths = @(
    "$env:SystemDrive\inetpub\logs\LogFiles",
    "$env:ExchangeInstallPath\Logging",
    "C:\Scripts"
)

foreach ($Path in $LogPaths) {
    if (Test-Path $Path) {
        $Acl = Get-Acl $Path
        $AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("svc-ExchangeCleanup", "FullControl", "ContainerInherit,ObjectInherit", "None", "Allow")
        $Acl.SetAccessRule($AccessRule)
        Set-Acl $Path $Acl
        Write-Host "Granted permissions to $Path"
    }
}

Start-Process powershell -Credential (Get-Credential svc-ExchangeCleanup) -ArgumentList "-File C:\Scripts\CleanupExchangeLogs.ps1 -Days 7 -DoNotDelete"

Create a scheduled task to run the cleanup script automatically. This ensures consistent maintenance without manual intervention.

Create the scheduled task using PowerShell:

$TaskName = "Exchange Log Cleanup"
$ScriptPath = "C:\Scripts\CleanupExchangeLogs.ps1"
$TaskAction = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-ExecutionPolicy Bypass -File `"$ScriptPath`" -Days 7"
$TaskTrigger = New-ScheduledTaskTrigger -Daily -At "2:00 AM"
$TaskSettings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable
$TaskPrincipal = New-ScheduledTaskPrincipal -UserId "svc-ExchangeCleanup" -LogonType ServiceAccount

Register-ScheduledTask -TaskName $TaskName -Action $TaskAction -Trigger $TaskTrigger -Settings $TaskSettings -Principal $TaskPrincipal -Description "Daily cleanup of Exchange Server log files"

Alternatively, create the task through Task Scheduler GUI:

1. Open Task Scheduler (taskschd.msc)
2. Create Basic Task → Name: "Exchange Log Cleanup"
3. Trigger: Daily at 2:00 AM
4. Action: Start a program
5. Program: powershell.exe
6. Arguments: -ExecutionPolicy Bypass -File "C:\Scripts\CleanupExchangeLogs.ps1" -Days 7
7. Run as: svc-ExchangeCleanup

Start-ScheduledTask -TaskName "Exchange Log Cleanup"
Get-ScheduledTask -TaskName "Exchange Log Cleanup" | Get-ScheduledTaskInfo

Set up monitoring to ensure your cleanup script is working effectively and not causing issues.

Create a simple monitoring script to track disk space trends. Save as C:\Scripts\MonitorDiskSpace.ps1:

# Disk Space Monitoring Script
$LogFile = "C:\Scripts\DiskSpaceLog.txt"
$Volume = Get-Volume C
$Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
$FreeSpaceGB = [math]::Round($Volume.SizeRemaining / 1GB, 2)
$UsedSpacePercent = [math]::Round((($Volume.Size - $Volume.SizeRemaining) / $Volume.Size) * 100, 2)

$LogEntry = "$Timestamp - Free Space: $FreeSpaceGB GB ($UsedSpacePercent% used)"
Add-Content -Path $LogFile -Value $LogEntry

# Alert if disk usage exceeds 85%
if ($UsedSpacePercent -gt 85) {
    Write-EventLog -LogName Application -Source "Exchange Cleanup" -EventId 1001 -EntryType Warning -Message "Disk usage is $UsedSpacePercent% - cleanup may need adjustment"
}

Check the Windows Event Log for cleanup activities:

Get-WinEvent -FilterHashtable @{LogName='Application'; StartTime=(Get-Date).AddDays(-1)} | Where-Object {$_.LevelDisplayName -eq 'Information' -and $_.Message -like '*Exchange*'}

Review the scheduled task history:

Get-ScheduledTask -TaskName "Exchange Log Cleanup" | Get-ScheduledTaskInfo

# Check oldest files in log directories
$LogPaths = @("$env:SystemDrive\inetpub\logs\LogFiles", "$env:ExchangeInstallPath\Logging")
foreach ($Path in $LogPaths) {
    if (Test-Path $Path) {
        $OldestFile = Get-ChildItem -Path $Path -Recurse -File | Sort-Object LastWriteTime | Select-Object -First 1
        Write-Host "Oldest file in $Path`: $($OldestFile.LastWriteTime) - $($OldestFile.Name)"
    }
}