Discovery Search Mailbox

When I run searches using ECP they seem to work. 
When I run the same search and try to save the data in the Discovery Search Mailbox it just hangs and nothing gets written.
One little caveat this was working 4 days ago and now does not
Any ideas?

Hi,
Running setup /p  will only recreate the account in Active Directory. The next step is to enable the account and described in the below Technet Article.
Re-create Discovery and Other System Mailboxes in Exchange 2010
http://technet.microsoft.com/en-us/library/gg588318(v=exchg.141).aspx
This mailbox is not an Arbitration Mailbox and you shouldn't see it when running
Get-Mailbox -Arbitration
Martina Miskovic

Similar Messages

  • Move the discovery search mailbox

    Hi
    Is there a way to move the default Discovery Search Mailbox from one database to another? Or do I have to delete the one I have and create a new on in another database?
    Pittbull

    Is the user that you're logged in as part of the "Organization Management" group in AD?  I had to add myself to that before I could manage anything in the EMC or Powershell.
    Also, not sure where I found these, but I ended up running these commands in PS to move the built-in mailboxes from the database that Exchange 2010 setup made to ones that I created later.
    get-mailbox -Database "Mailbox Database 0237090912" | New-MoveRequest -TargetDatabase "TARGETDATABASENAME”
    get-mailbox -Database "Mailbox Database 0237090912" -arbitration | New-MoveRequest -TargetDatabase "TARGETDATABASENAME”
    Where "Mailbox Database 0237090912" is the database Exchange 2010 made and "TARGETDATABSE" is the database you're moving everything to.
    P.S.  I thought I'd add that I got this info from this site: 
    http://www.howexchangeworks.com/2009/11/error-while-deleting-default-mailbox.html
    The first get-mailbox command actually moves all of the mailboxes (including Discovery) from the first database to the second.  The second command does the same thing for all of the arbitration mailboxes.

  • Cannot move Exchange 2013 "Discovery Search Mailbox" to DAG database! :(

    I  want to get rid of the default mailbox database but it won't allow me because it says it still have mailboxes. I ran:
    "Get-mailbox -database "Default Mailboxdatabase name" and it shows the "DiscoverySearchMailbox" still there. I was able to move all the other arbitration mailboxes to my DAG database.
    I then ran:
    Get-mailbox -database "DB Name" | new-moverequest -targetdatabase "DB Name"
    and
    Get-Mailbox -Filter { RecipientTypeDetails -eq "DiscoveryMailbox" } | new-moverequest -targetdatabase "DB Name"
    and both times I receive a long error:
    MapiExceptionMdbOffline: Unable to make connection to the server. (hr=0x80004005, ec=1142)
    Diagnostic context:
        Lid: 41192   dwParam: 0x1
        Lid: 49384
        Lid: 51176   StoreEc: 0x476
        Lid: 48104
        Lid: 39912   StoreEc: 0x476
        Lid: 41192   dwParam: 0x2
        Lid: 49384
        Lid: 51176   StoreEc: 0x476
        Lid: 48104
        Lid: 39912   StoreEc: 0x476
        Lid: 41192   dwParam: 0x0
        Lid: 49064   dwParam: 0x1
        Lid: 38439   EMSMDBPOOL.EcPoolConnect called [length=48]
        Lid: 54823   EMSMDBPOOL.EcPoolConnect returned [ec=0x476][length=20][latency=0]
        Lid: 53361   StoreEc: 0x476
        Lid: 51859
        Lid: 33649   StoreEc: 0x476
        Lid: 43315
        Lid: 58225   StoreEc: 0x476
        Lid: 39912   StoreEc: 0x476
        Lid: 54129   StoreEc: 0x476
        Lid: 50519
        Lid: 59735   StoreEc: 0x476
        Lid: 59199
        Lid: 27356   StoreEc: 0x476
        Lid: 65279
        Lid: 52465   StoreEc: 0x476
        Lid: 60065
        Lid: 33777   StoreEc: 0x476
        Lid: 59805
        Lid: 52487   StoreEc: 0x476
        Lid: 19778
        Lid: 27970   StoreEc: 0x476
        Lid: 17730
        Lid: 25922   StoreEc: 0x476
        + CategoryInfo          : NotSpecified: (:) [New-MoveRequest], RemoteTransientException
        + FullyQualifiedErrorId : [Server=LA3-EXMBW002,RequestId=cb04b084-0dd7-46b9-bf57-6d3317013d47,TimeStamp=3/14/2014 10:44:34 PM] 7A53F855,Microsoft.Exchange.Management.RecipientTasks.NewMoveRequest
    Any ideas on moving that Discovery Mailbox? Thx!

    MapiExceptionMdbOffline: Unable to make connection to the server. (hr=0x80004005, ec=1142)
    That error indicates that the database is not mounted, so mounted and try again.
     A workaround if you can't move the mailbox, is to rehome the mailbox to another database.
     Example:
     Get-Mailbox Discover* | Set-Mailbox -database <DB Name>
    Martina Miskovic

  • Discovery search failed

    I'm not sure where to go with this one.  My administrator account is a member of the Organization Management and Discovery Management roles.  Using this account, when I run a Discovery search against another mailbox, it fails with the following
    error:
    An error occurred when searching <MAILBOX>. The message is 'Exchange Web Service call for keywords statistics information failed. Error: Invalid search query syntax or the query contains invalid search properties.'
    If I run the Discovery Search against my administrator account, using the exact same criteria and using my administrator account, the search succeeds.  Any help is appreciated.
    jason

    Hi,
    I have a test in my environment using Exchange 2010. If I add administrator to Discovery Management role group, I can search all the mailboxes in my environment using the following cmdlet.
    New-MailboxSearch -Name "test1" -SourceMailboxes
    [email protected] -TargetMailbox "Discovery Search Mailbox"
    Please take your time to post the method you use and the detailed error information for my further research.
    Hope it helps.
    Best regards,
    Amy
    Amy Wang
    TechNet Community Support

  • In Place Discovery Search - "Search in Progress", not progressing?

    Hi,
    When I click SAVE to run the In Place Discovery Search, it just seems to stay "in progress" and never complete.
    I can run an estimate on the search and it seems to work fine.
    No errors to report?
    Suggestions?

    Hi,
    From your description, if you select "Estimate the search result", it succeeds. But if you select "Copy the search results to the destination mailbox", it will be in progress. If I have misunderstood your concern, please let me know.
    In your case, I recommend you click Refresh and check the result. In my environment, when I do the discovery search, it also displays "Search In progress" for a long time, but when I click Refresh, it displays the discovery result immediately.
    Hope it helps.
    Best regards,
    Amy Wang
    TechNet Community Support

  • -DeleteContent switch for Search-Mailbox Cmdlet does not work

    Apologies if this isn't the right forum for this question. 
    I'm having trouble with the Search-Mailbox cmdlet, specifically when I'm attempting to use the -DeleteContent switch in order to delete a message from a specific user's mailbox. 
    I attempt to run the command: 
    Search-Mailbox -identity "Some User" -DeleteContent -SearchQuery 'Subject:"Spam Email Subject Heading"'
    And I get:
    A positional parameter cannot be found that accepts argument '-DeleteContent'.
        + CategoryInfo          : InvalidArgument: (:) [Search-Mailbox], ParameterBindingException
        + FullyQualifiedErrorId : PositionalParameterNotFound,Search-Mailbox
    Any idea what could be causing this issue? It's as if the shell does not recognize the existence of the -DeleteContent switch. I have no issues at all with the Search-Mailbox cmdlet except when it comes to using that switch. 
    Some background:
    - Yes, I am running the shell as an admin.
    - I'm running EMS on my Exchange server itself through an RDS instance.
    - Running Exchange Server 2010 - Version: 14.03.0181.006
    - My user account is a member of: Discovery Management, Organization Management, Recipient Management, Records Management, Server Management, and UM Management.
    Thank you in advance for any help any of you can provide!

    The exchange blog team has contained
    here with good explanation in detail about removing the specific user mailbox in exchange 2010. Please check this.

  • Search-Mailbox not attaching the infected emails in target folder and deleting the contents in exchange 2010 & 2013 coexistence

    Dear All,
    I have an issue with deleting circulated spam emails in my environment through search-mailbox
    We have Exchange 2010 & 2013  CU5 environment 
    I followed the search and destroy document for exchange 2010 
    http://windowsitpro.com/exchange-server-2010/search-destroy-email-content-exchange-2010
    Added the user to Discovery Management group
    Created a new role group as below 
    New-RoleGroup "Mailbox Import-Export Management" -Roles "Mailbox Import Export"
    Add-RoleGroupMember "Mailbox Import-Export Management" -Member Administrator
    I ran the below commands
    Search-Mailbox -Identity "[email protected]" -SearchQuery "Subject:'report'" -TargetMailbox "Administrator" -TargetFolder "Filter" -LogOnly -LogLevel Full
    The above command gets completed successfully and sends the log report  however im unable to see any attachments
    Similarly the deletecontent also gets completed successfully and logs result. But it does not delete the infected emails 
    Search-Mailbox -Identity  "[email protected]" -SearchQuery "Subject:'report'" -TargetMailbox "administrator" -TargetFolder "filter" -deletecontent -LogLevel Full
    Any idea why it is not fetching the infected emails in zip file and why it is not deleting but it is able to log in the target folder 
    Any help much appreciated
    Remember to mark as helpful if you find my contribution useful or as an answer if it does answer your question.That will encourage me - and others - to take time out to help you Check out my latest blog posts on http://exchangequery.com Thanks Sathish (MVP)

    Hi All 
    I managed to find the solution. Below command helped me in solving the issue 
    get-mailbox -ResultSize unlimited -IgnoreDefaultScope | search-mailbox -SearchQuery ‘Subject:"virus infected"’ -LogOnly -TargetMailbox administrator -TargetFolder filter -LogLevel Full
    get-mailbox -ResultSize unlimited -IgnoreDefaultScope | search-mailbox -SearchQuery ‘Subject:"virus infected"’ -TargetMailbox administrator -TargetFolder filter -deletecontent -LogLevel Full
    Remember to mark as helpful if you find my contribution useful or as an answer if it does answer your question.That will encourage me - and others - to take time out to help you Check out my latest blog posts on http://exchangequery.com Thanks Sathish
    (MVP)

  • Ex2010 Discovery Search - Get only messages between certain addresses?

    Hello all,
    Is there any way when performing discovery searches in Exchange 2010 that you can search for emails between two email addresses ONLY? For example, I'm searching a users mailbox for emails from [email protected] My returned results include all emails that
    [email protected] is a part of, such as emails from the mailbox being searched being sent to [email protected] that [email protected] was CC'ed on.
    I only want to return e-mails that the user of the searched mailbox and [email protected] are on....nobody else.
    Is this even possible?
    Tom K.

    yes it is - use the ECP - make sure you are part of Discovery Management Role Group
    Where Technology Meets Talent

  • E-discovery search results

    A user complained that some of her sent items are no longer in her sent folder. I ran an e-discovery search on her mailbox and found those emails. How do i know what had happened to these emails, which folder they are currently located and who moved these
    emails? I have auditing enabled.
    When i search this users entire mailbox i cant find the emails that i was able to find in the e-discovery search.
    Thank you.

    Hi ,
    1.Please check those emails is on the deleted items or else on recovery deleted items folder.
    2.If that particular mailbox is having an single item recovery enabled then the emails deleted from the recovery deleted items will be saved on the purges folder untill the retention period is passed.
    get-mailboxfolderstatistics -identity "problematic mailbox" | fl
    With the help of that above command we can able to find out the size and items on each and every folder in an mailbox
    3.Then for auditing you need to run the below mentioned command to find who has done that.
    Make sure the account which you are trying to run this command is an member of organisation management and records management group .
    search-mailboxauditlog -identity "mailbox which is under audit" -showdetails | fl 
    Note : The actions which you are trying to tracks needs to be included on the audit admin and audit delegate
    for the mailbox which is under audit.
    Please feel free to reply me if you have any queries.
    Thanks & Regards S.Nithyanandham

  • Search-Mailbox -deletecontent...not deleting all items?

    Hi, I am trying to purge some data from my Exchange server. I am running:
    Search-Mailbox -id username -searchquery "system.message.datareceived:01/01/2011..01/09/2011" -DeleteContent
    The first time I ran this against a mailbox it went off and deleted a load of mail. But looking into things further, there is still lots of mail that was received in the period stated. Not sure why the cmd hasn;t got rid of this as well? Also tried system.message.datesent
    but again when I run this the log states that there is nothing to delete, even though I have over 200 emails from June-Sept. Whats the deal here?

    Hi,
    Please try the following command and check:
    Search-Mailbox -Identity <username> -SearchQuery "Received:> $('01/01/2011 00:00:00') and Received:< $('01/09/2011 23:59:59')"
    –DeleteContent
    Hope it helps. If this issue still occurs, please let us know.
    Thanks
    Sophia Xu
    TechNet Community Support

  • Searching for calendar items older than a specific date with search-mailbox and AQS

    I need to find the total size of all calendar items in a mailbox older than a specified date using PowerShell through the search-mailbox cmdlet's searchquery parameter.  My problem is that I cannot find a complete list of Calendar item properties to
    use in search queries.  The AQS page doesn't have a complete list of properties for a Calendar object.
    I'm using code from the ArchiveStatisticsPlanner.ps1 script as a base and the only date properties I know of are the sent and receive properties (see below.)  The basic start, end, date properties generate errors in the query.  How can I find all
    Calendar items older than say, 1/1/2013?
    Sample:
    $MBXSearch=Search-Mailbox-Identity$MBX-SearchQuery"kind:calendar
    sent:<=$QueryDate OR kind:calendar received:<=$QueryDate"-EstimateResultOnly-DoNotIncludeArchive

    huh, you a get response marked as answer that wasn't very helpful.
    EDIT: and now I'm reported as abusive.  Please don't tell the truth on these forums, it seems to be frowned upon
    I did that.
    If you're going to necro an answered thread and attempt to hijack it, you should have an actual answer that you feel is more relevant.
    All you did was complain and add zero useful information, thus earning an 'offtopic/irrelevant' notation.
    Don't retire TechNet! -
    (Don't give up yet - 13,085+ strong and growing)

  • Search-Mailbox -SearchQuery not filtering time correctly

    After reading: http://technet.microsoft.com/en-us/library/dd298173(v=exchg.150).aspx
    which links off to: http://msdn.microsoft.com/library/ee558911%28v=office.15%29.aspx
    I made the following PowerShell script for testing before I start deleting anything:
    $A=Get-Date '18/7/2014'
    $Start=Get-Date $A.ToUniversalTime() -Format yyyy-MM-ddThh:mm:ss
    $End=Get-Date $A.AddDays(1).ToUniversalTime() -Format yyyy-MM-ddThh:mm:ss
    $SearchQuery='Received>="'+$Start+'" AND Received<"'+$End+'"'
    Search-Mailbox -Identity 'mailbox@domain' -SearchQuery $SearchQuery -TargetMailbox 'targetmailbox@domain' -TargetFolder Inbox -LogOnly -LogLevel Full
    The results I get back are all the emails between 17/7/2014 12:00 AM - 18/7/2014 12:00 AM
    When I thought it should be the emails between 17/7/2014 2:30 PM - 18/7/2014 2:30 PM (Our time zone is +9:30)
    Does the query I'm passing to -SearchQuery need tweaking or am I doing something else wrong?
    The $SearchQuery variable expands out to this:
    Received>="2014-07-17T02:30:00" AND Received<"2014-07-18T02:30:00"
    I'm using the Search-Mailbox cmdlet because is wish to adjust this script to use the -DeleteContent paramater

    Hi,
    I recommend you post this in
    Powershell Forum also, as they should have more professional knowledge on scripting and you may get effective solution timely.
    Thanks.
    Niko Cheng
    TechNet Community Support

  • Search-Mailbox limitations

    I have an Exchange Server 2010 mailbox which receives alert messages on the order of 800,000+ a day.  I am working on getting the developers to change their code, but in the meantime, I am looking for ways to clear out the mailbox.  I have
    a Search-Mailbox script with the -deletecontent switch that works, but there appears to be an upper limit on the number of messages it can handle.  Based on my experience the upper limit lies between 300,000 (my script does work here) and 690,000 (my
    script does not work at this level).
    I have tried using a Retention Policy, but that didn't work either.  I am currently looking at the following options:
    1) Put in an Inbox Rule that permanently deletes the error messages.
    2) Investigate using a Transport Rule.
    3) Letting the mailbox fill up again and let the Developers get the message that they need to clean up their code.  - my favorite as I believe anything else is just enabling bad behavior.
    Thoughts?
    TIA
    Nate
    nc

    Hi,
    In your case, you can create Inbox rule or transport rule to delete these messages.
    From my point of veiw, you need to figure out the root cause of this issue why this mailbox receives a large amount of alert messages.
    You can check the application log to see if there is any related events.
    Best regards,
    If you have feedback for TechNet Subscriber Support, contact
    [email protected]
    Belinda Ma
    TechNet Community Support

  • Search-mailbox phrase

    Hello 
    I'm running Exchange 2013 sp1. I need to search for  emails that contain a specific phrase, delete the emails and log the results. I have come up with two different commands, but not sure which one is better to use.
    #1 Search-Mailbox  -SearchDumpster:$true  -SearchQuery {Subject:"look document" -and sent:"11/23/2014..11/24/2014"} -deletecontent -loglevel full
    #2 Search-Mailbox -searchdumpster:$true -SearchQuery 'Subject: look document ' -DeleteContent -confirm:$false
    Bulls on Parade

    Hi,
    You can use the cmdlets below to search specified messages and delete them.
    Search-Mailbox -Identity xxx -searchdumpster:$true -SearchQuery "Subject:test" -DeleteContent -confirm:$false
    Search-Mailbox -Identity xxx -SearchDumpster:$true -SearchQuery {Subject:"test" -and sent:"11/11/2014..12/2/2014"} -TargetFolder xxx -TargetMailbox xxx -deletecontent -loglevel full
    There are some differences between them, but both of them work well. The first one doesn't specify the start date and end date. What's more, the second one specifies the logging level for the search. You can choose one according to your needs.
    What's more, here is a thread for your reference.
    Search-Mailbox
    http://technet.microsoft.com/en-us/library/dd298173(v=exchg.150).aspx
    Hope this can be helpful.
    Best regards,
    If you have feedback for TechNet Subscriber Support, contact
    [email protected]
    Amy Wang
    TechNet Community Support

  • Search-Mailbox -identity & DeleteContent

    Hi. I ran powershell scripts on a users mailbox (test lab):
    Search-Mailbox -identity 'user name' -SearchQuery '(received:01/02/2003..21/01/2014) AND (kind:email)' -DeleteContent
    Search-Mailbox -identity 'user name' -SearchQuery '(received:01/02/2003..21/01/2014 AND (kind:meetings)' -DeleteContent 
    When I compared the results post script execution 'Test-Lab Vs Production' the email retained in the Test Lab mailbox were not as expected. 
    9 Emails remained in the users Mailbox. Received date varied. The 4 dated 22/01/2014 were expected. The additional 5 were not. I would have expected these to have been deleted.
    22/01/2014 x 4
    23/09/2013 * 1
    10/04/2013 x 1
    02/01/2013 x 1
    06/12/2012 x 1
    22/01/2012 x 1
    The script to remove calendar appointments appears to have deleted ALL appointment's (future > 2101/2014).
    Is anybody able to shed some light as to why I am seeing the results that I am?
    Kind Regards,
    Phil. 
    IT Manager

    Hi,
    I recommend you using the following command to delete a specific email you mentioned above that was not deleted to check if the email could be deleted.
    search-mailbox -identity username -searchquery subject:'emailsubject' -deletecontent
    Best regards,
    Belinda
    Belinda Ma
    TechNet Community Support

Maybe you are looking for