PowerShell Search-Mailbox cmdlet filtering language differences: AQS, KQL, FQL

In Exchange 2010, Search-Mailbox uses AQS as the filtering language. We're preparing to move to Exchange 2013 and want to make sure that the processes we used to search for particular types of emails gets updated before-hand. Initially when we
were looking at Exchange 2013, it appears Search-Mailbox changes to use KQL/FQL (??) so we assumed this would break the search filters we've already written for Search-Mailbox. However, after looking at the syntax for KQL, it looks nearly identical to
AQS and it appears the queries we have written using AQS filters may natively work in Ex2013 with KQL -- can anyone confirm or deny this? If so, it would seem a very close familial language structure between the two (AQS/KQL) but I was unable to find
any documentation on technet connecting them. Does anyone know of any documentation that discusses the move of filtering languages and the deltas them?
TIA.

Hi,
The Advanced Query Syntax (AQS) and Keyword Query Language (KQL), they are two different query languages for different Exchange versions, even though KQL is similar to AQS.
I searched from internal channel, there may be some restrictions when you use
AQS query in Exchange 2013.
I recommend modify your search filters after you migrate to Exchange 2013.
Best regards,
Belinda Ma
TechNet Community Support

Similar Messages

-DeleteContent switch for Search-Mailbox Cmdlet does not work

Apologies if this isn't the right forum for this question.
I'm having trouble with the Search-Mailbox cmdlet, specifically when I'm attempting to use the -DeleteContent switch in order to delete a message from a specific user's mailbox.
I attempt to run the command:
Search-Mailbox -identity "Some User" -DeleteContent -SearchQuery 'Subject:"Spam Email Subject Heading"'
And I get:
A positional parameter cannot be found that accepts argument '-DeleteContent'.
+ CategoryInfo : InvalidArgument: (:) [Search-Mailbox], ParameterBindingException
+ FullyQualifiedErrorId : PositionalParameterNotFound,Search-Mailbox
Any idea what could be causing this issue? It's as if the shell does not recognize the existence of the -DeleteContent switch. I have no issues at all with the Search-Mailbox cmdlet except when it comes to using that switch.
Some background:
- Yes, I am running the shell as an admin.
- I'm running EMS on my Exchange server itself through an RDS instance.
- Running Exchange Server 2010 - Version: 14.03.0181.006
- My user account is a member of: Discovery Management, Organization Management, Recipient Management, Records Management, Server Management, and UM Management.
Thank you in advance for any help any of you can provide!

The exchange blog team has contained
here with good explanation in detail about removing the specific user mailbox in exchange 2010. Please check this.

Searching for calendar items older than a specific date with search-mailbox and AQS

I need to find the total size of all calendar items in a mailbox older than a specified date using PowerShell through the search-mailbox cmdlet's searchquery parameter. My problem is that I cannot find a complete list of Calendar item properties to
use in search queries. The AQS page doesn't have a complete list of properties for a Calendar object.
I'm using code from the ArchiveStatisticsPlanner.ps1 script as a base and the only date properties I know of are the sent and receive properties (see below.) The basic start, end, date properties generate errors in the query. How can I find all
Calendar items older than say, 1/1/2013?
Sample:
$MBXSearch=Search-Mailbox-Identity$MBX-SearchQuery"kind:calendar
sent:<=$QueryDate OR kind:calendar received:<=$QueryDate"-EstimateResultOnly-DoNotIncludeArchive

huh, you a get response marked as answer that wasn't very helpful.
EDIT: and now I'm reported as abusive. Please don't tell the truth on these forums, it seems to be frowned upon
I did that.
If you're going to necro an answered thread and attempt to hijack it, you should have an actual answer that you feel is more relevant.
All you did was complain and add zero useful information, thus earning an 'offtopic/irrelevant' notation.
Don't retire TechNet! -
(Don't give up yet - 13,085+ strong and growing)

Search-Mailbox -SearchQuery not filtering time correctly

After reading: http://technet.microsoft.com/en-us/library/dd298173(v=exchg.150).aspx
which links off to: http://msdn.microsoft.com/library/ee558911%28v=office.15%29.aspx
I made the following PowerShell script for testing before I start deleting anything:
$A=Get-Date '18/7/2014'
$Start=Get-Date $A.ToUniversalTime() -Format yyyy-MM-ddThh:mm:ss
$End=Get-Date $A.AddDays(1).ToUniversalTime() -Format yyyy-MM-ddThh:mm:ss
$SearchQuery='Received>="'+$Start+'" AND Received<"'+$End+'"'
Search-Mailbox -Identity 'mailbox@domain' -SearchQuery $SearchQuery -TargetMailbox 'targetmailbox@domain' -TargetFolder Inbox -LogOnly -LogLevel Full
The results I get back are all the emails between 17/7/2014 12:00 AM - 18/7/2014 12:00 AM
When I thought it should be the emails between 17/7/2014 2:30 PM - 18/7/2014 2:30 PM (Our time zone is +9:30)
Does the query I'm passing to -SearchQuery need tweaking or am I doing something else wrong?
The $SearchQuery variable expands out to this:
Received>="2014-07-17T02:30:00" AND Received<"2014-07-18T02:30:00"
I'm using the Search-Mailbox cmdlet because is wish to adjust this script to use the -DeleteContent paramater

Hi,
I recommend you post this in
Powershell Forum also, as they should have more professional knowledge on scripting and you may get effective solution timely.
Thanks.
Niko Cheng
TechNet Community Support

Search-Mailbox for Message Header Content in Management Shell

Can I use the search-mailbox command to search for message header content?
The reason I ask is because I need to search for any emails that came in to an email alias address.
I am searching a journaling mailbox.
Normally, I would do soemthing like...
Search-Mailbox -Identity "journalbox" -SearchQuery '"To: [email protected]"' -TargetMailbox "exportbox" -TargetFolder "exported_messages"
The problem is, because I'm looking to find the emails coming to [email protected], when the messages are journaled they appear as "To: [email protected]" in the journaled envelop message.
In this scenario if I could simply search header content for the email ([email protected]) that would accomplish what I need.

Hi,
We can use the Search-Mailbox cmdlet to search messages in a specified mailbox and perform any of the following tasks:
Copy messages to a specified target mailbox.
Delete messages from the source mailbox.
Copy messages from the source mailbox and delete them from the target mailbox.
Perform single item recovery to recover items from a user's Recoverable Items folder.
Clean up the Recoverable Items folder for a mailbox when it has reached the Recoverable Items hard quota.
To search for message header content, we can use Get-MessageTrackingLog cmdlet.
Here is an article for reference:
http://exchangeserverpro.com/exchange-2010-message-tracking-log-search-powershell/
Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety,
or suitability of any software or information found there. Please make sure that you completely understand the risk before retrieving any suggestions from the above link.
Best Regards.

Exchange 2010 SP3 - Search-Mailbox -DeleteContent fails: the search folder timed out.

We have a bunch of users that have hundreds of thousands of Undelivered Mail Returned to Sender email in their inbox. I believe these mailboxes were compromised and were sending out spam. We have fixed that issue, but I am trying to clean out all these messages
from their inbox. I have run this command successfully on a few users, but this one in particular is giving me troubles. This mailbox has over 400,000 items to delete so I am wondering if there are just too many to process.
Search-Mailbox -Identity EMAIL -SearchQuery "Subject:'Undelivered Mail Returned to Sender'" -DeleteContent
Here is the error:
The search on mailbox ....... did not complete because the search folder timed out.
+ CategoryInfo : ReadError: (0:Int32) [Search-Mailbox], SearchFolderTimeoutException
+ FullyQualifiedErrorId : EC2CC554,Microsoft.Exchange.Management.Tasks.SearchMailbox
I don't like the idea of having to delete these manually. If someone has an idea that would be fantastic.
Thanks

Hi,
Based on the description, you couldn't run the search-mailbox cmdlet to delete all items after several times. I discussed with my colleagues, there is a limit when trying to delete items using search-mailbox cmdlet, it's 10000 at a time if a search query
is specified. The error you got may be related to the large amount of items. Some scripts may help you to delete them all at a time, you can ask this question on the Script forum to get a better help.
As a workaround, you can create an Outlook Inbox rule for these messages and move them to a specific folder. After that, you can delete the folder permanently.
Here is a similar thread for your reference.
http://community.office365.com/en-us/f/158/t/239292.aspx
Best regards,
Belinda
Belinda Ma
TechNet Community Support

Search-mailbox phrase

Hello
I'm running Exchange 2013 sp1. I need to search for emails that contain a specific phrase, delete the emails and log the results. I have come up with two different commands, but not sure which one is better to use.
#1 Search-Mailbox -SearchDumpster:$true -SearchQuery {Subject:"look document" -and sent:"11/23/2014..11/24/2014"} -deletecontent -loglevel full
#2 Search-Mailbox -searchdumpster:$true -SearchQuery 'Subject: look document ' -DeleteContent -confirm:$false
Bulls on Parade

Hi,
You can use the cmdlets below to search specified messages and delete them.
Search-Mailbox -Identity xxx -searchdumpster:$true -SearchQuery "Subject:test" -DeleteContent -confirm:$false
Search-Mailbox -Identity xxx -SearchDumpster:$true -SearchQuery {Subject:"test" -and sent:"11/11/2014..12/2/2014"} -TargetFolder xxx -TargetMailbox xxx -deletecontent -loglevel full
There are some differences between them, but both of them work well. The first one doesn't specify the start date and end date. What's more, the second one specifies the logging level for the search. You can choose one according to your needs.
What's more, here is a thread for your reference.
Search-Mailbox
http://technet.microsoft.com/en-us/library/dd298173(v=exchg.150).aspx
Hope this can be helpful.
Best regards,
If you have feedback for TechNet Subscriber Support, contact
[email protected]
Amy Wang
TechNet Community Support

Search-Mailbox -identity & DeleteContent

Hi. I ran powershell scripts on a users mailbox (test lab):
Search-Mailbox -identity 'user name' -SearchQuery '(received:01/02/2003..21/01/2014) AND (kind:email)' -DeleteContent
Search-Mailbox -identity 'user name' -SearchQuery '(received:01/02/2003..21/01/2014 AND (kind:meetings)' -DeleteContent
When I compared the results post script execution 'Test-Lab Vs Production' the email retained in the Test Lab mailbox were not as expected.
9 Emails remained in the users Mailbox. Received date varied. The 4 dated 22/01/2014 were expected. The additional 5 were not. I would have expected these to have been deleted.
22/01/2014 x 4
23/09/2013 * 1
10/04/2013 x 1
02/01/2013 x 1
06/12/2012 x 1
22/01/2012 x 1
The script to remove calendar appointments appears to have deleted ALL appointment's (future > 2101/2014).
Is anybody able to shed some light as to why I am seeing the results that I am?
Kind Regards,
Phil.
IT Manager

Hi,
I recommend you using the following command to delete a specific email you mentioned above that was not deleted to check if the email could be deleted.
search-mailbox -identity username -searchquery subject:'emailsubject' -deletecontent
Best regards,
Belinda
Belinda Ma
TechNet Community Support

Search-Mailbox Search Query not returning correct results.

Hi,
I'd appreciate some assistance with the search and delete I'm trying to I'm run.
I'm using the following command to find messages with a certain message class received before 01/01/14 in a mailbox.
Get-Mailbox xxxxxxxxxxxxxxx | Search-Mailbox -SearchQuery '(Received:< 01/01/14) AND ("IPM.Note.Worksite.Ems.Filed")' -EstimateResultOnly | select displayname, success, resultitemscount,Resultitemssize
When I first ran the command it returned 130,000 items, I ran it again with a -DeleteContent switch, all the items were successfully removed from the mailbox, great! However, when I look in the mailbox I can see ~1000 items with the message class in the command
and dated 2013 or earlier, they meet the search criteria so I don't understand why when I run the command again it returns 0 items.
Help!

Hello,
Based on your description, your cmdlet is ok.
When you run the cmdlet with a -DeleteContent switch, the messages are not delete permanently. please try to run the cmdlet with a -DeleteContent switch and -Force switch to check the result.
Besides, please use get-mailboxstatistics | fl cmdlet to check information about mailbox.
Cara Chen
TechNet Community Support

Move the discovery search mailbox

Hi
Is there a way to move the default Discovery Search Mailbox from one database to another? Or do I have to delete the one I have and create a new on in another database?
Pittbull

Is the user that you're logged in as part of the "Organization Management" group in AD? I had to add myself to that before I could manage anything in the EMC or Powershell.
Also, not sure where I found these, but I ended up running these commands in PS to move the built-in mailboxes from the database that Exchange 2010 setup made to ones that I created later.
get-mailbox -Database "Mailbox Database 0237090912" | New-MoveRequest -TargetDatabase "TARGETDATABASENAME”
get-mailbox -Database "Mailbox Database 0237090912" -arbitration | New-MoveRequest -TargetDatabase "TARGETDATABASENAME”
Where "Mailbox Database 0237090912" is the database Exchange 2010 made and "TARGETDATABSE" is the database you're moving everything to.
P.S. I thought I'd add that I got this info from this site:
http://www.howexchangeworks.com/2009/11/error-while-deleting-default-mailbox.html
The first get-mailbox command actually moves all of the mailboxes (including Discovery) from the first database to the second. The second command does the same thing for all of the arbitration mailboxes.

Cannot send email from Powershell on Mailbox Role

Hi,
I am trying to send an email from Powershell on Mailbox role of Exchange server. I have installed Symantec Mail Security on Mailbox Role.
When I try to send email using Powershell, I got the following error.
PS C:\a> Send-MailMessage -to [email protected] -Subject "Alert Closed.. Service is restarted on Computer" -from
[email protected] -Body "The service was found stopped on Computer it was started automatically and it is now running normally." -bodyasHTML -priority High -SmtpServer smtp.domain.com
Send-MailMessage : Service not available, closing transmission channel. The server response was: 4.3.2 Service not active
At line:1 char:1
+ Send-MailMessage -to [email protected] -Subject "Alert Closed.. Service is ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (System.Net.Mail.SmtpClient:SmtpClient) [Send-MailMessage], SmtpException
+ FullyQualifiedErrorId : SmtpException,Microsoft.PowerShell.Commands.SendMailMessage
This command is working fine on every server except exchange server (CAS, Mailbox). Firewall is off on the servers.
Any help will be highly appreciated.
Regards,
Anees

Hi,
Please check the similar thread .
http://social.technet.microsoft.com/Forums/exchange/en-US/ef699832-8da9-4709-9a50-c6223b13bd95/sendmailmessage-returns-the-server-response-was-432-service-not-available?forum=exchangesvrsecuremessaginglegacy
smtp server (smtp.domain.com) is rejecting the connection from the
Mailbox role of Exchange server.
So please allow the mailbox server ip address on the smtp server's (i.e. smtp.domain.com)
receive connector to get it done
Regards
S.Nithyanandham
Thanks S.Nithyanandham

Search-Mailbox -deletecontent...not deleting all items?

Hi, I am trying to purge some data from my Exchange server. I am running:
Search-Mailbox -id username -searchquery "system.message.datareceived:01/01/2011..01/09/2011" -DeleteContent
The first time I ran this against a mailbox it went off and deleted a load of mail. But looking into things further, there is still lots of mail that was received in the period stated. Not sure why the cmd hasn;t got rid of this as well? Also tried system.message.datesent
but again when I run this the log states that there is nothing to delete, even though I have over 200 emails from June-Sept. Whats the deal here?

Hi,
Please try the following command and check:
Search-Mailbox -Identity <username> -SearchQuery "Received:> $('01/01/2011 00:00:00') and Received:< $('01/09/2011 23:59:59')"
–DeleteContent
Hope it helps. If this issue still occurs, please let us know.
Thanks
Sophia Xu
TechNet Community Support

Search-Mailbox limitations

I have an Exchange Server 2010 mailbox which receives alert messages on the order of 800,000+ a day. I am working on getting the developers to change their code, but in the meantime, I am looking for ways to clear out the mailbox. I have
a Search-Mailbox script with the -deletecontent switch that works, but there appears to be an upper limit on the number of messages it can handle. Based on my experience the upper limit lies between 300,000 (my script does work here) and 690,000 (my
script does not work at this level).
I have tried using a Retention Policy, but that didn't work either. I am currently looking at the following options:
1) Put in an Inbox Rule that permanently deletes the error messages.
2) Investigate using a Transport Rule.
3) Letting the mailbox fill up again and let the Developers get the message that they need to clean up their code. - my favorite as I believe anything else is just enabling bad behavior.
Thoughts?
TIA
Nate
nc

Hi,
In your case, you can create Inbox rule or transport rule to delete these messages.
From my point of veiw, you need to figure out the root cause of this issue why this mailbox receives a large amount of alert messages.
You can check the application log to see if there is any related events.
Best regards,
If you have feedback for TechNet Subscriber Support, contact
[email protected]
Belinda Ma
TechNet Community Support

Pulling specific subject with search-mailbox

I'm trying to use search-mailbox in Exchange 2010 to find e-mails with a specific subject, but my query is pullling more than it should. Here's what I've got:
get-mailbox "Userbox" | search-mailbox -searchquery 'Subject:"Your e-mail will expire soon!"' -targetmailbox "adminbox" -targetfolder "adminfolder"
It's finding the e-mails I'm looking for, but it's also pulling e-mails with subjects like "Your driver's license will expire soon" and "Contracts for your review". How do I get the exact phrase? Right now, it looks like it's
OR-ing each word.
Thanks,
Matthew

Hi,
As the link mentioned which was provided by troy:
http://help.outlook.com/en-us/140/ms.exch.ecp.newmailboxsearch_searchquery.aspx
Exact phrases
Use double quotation marks ( " ) to search for exact terms or phrases. For example, "cat and dog" finds messages that contain the exact phrase
cat and dog. The search cat AND dog finds messages that contain both words somewhere in the message. Exact phrases can help you obtain more precise results.
In addition,according to your requirement,you can try the following command:
Search-Mailbox -Identity Usermailbox -SearchQuery 'Subject:"your e-mail will expire soon!" And From:[email protected]' -Targetmailbox adminbox -Targetfolder adminfolder
Hope this hleps!
Thanks.
Niko Cheng
TechNet Community Support

Search Engine Conversion Filters

Does each service pack of iplanet/sun one web server install newer conversion filters for the search engine (word, excel, pdf etc.)? Generally, how new are these filters compared to data formats (Office XP etc.)?
We are running iplanet 6 sp2 and the search engine seems to stumble with newer ms office and acrobat files. I have not been able to find any documentation whatsoever on obtaining and installation newer conversion filters. Any help would be greatly appreicated.
mojo

Typically the filters included in Service Packs are not changed unless there is a defect that needs addressing.
The SunONE Web Server uses the Verity search engine. Filters that work with Verity's offerings should work with SunONE WS.

PowerShell Search-Mailbox cmdlet filtering language differences: AQS, KQL, FQL

Similar Messages

Maybe you are looking for