Search-mailbox phrase

Hello
I'm running Exchange 2013 sp1. I need to search for emails that contain a specific phrase, delete the emails and log the results. I have come up with two different commands, but not sure which one is better to use.
#1 Search-Mailbox -SearchDumpster:$true -SearchQuery {Subject:"look document" -and sent:"11/23/2014..11/24/2014"} -deletecontent -loglevel full
#2 Search-Mailbox -searchdumpster:$true -SearchQuery 'Subject: look document ' -DeleteContent -confirm:$false
Bulls on Parade

Hi,
You can use the cmdlets below to search specified messages and delete them.
Search-Mailbox -Identity xxx -searchdumpster:$true -SearchQuery "Subject:test" -DeleteContent -confirm:$false
Search-Mailbox -Identity xxx -SearchDumpster:$true -SearchQuery {Subject:"test" -and sent:"11/11/2014..12/2/2014"} -TargetFolder xxx -TargetMailbox xxx -deletecontent -loglevel full
There are some differences between them, but both of them work well. The first one doesn't specify the start date and end date. What's more, the second one specifies the logging level for the search. You can choose one according to your needs.
What's more, here is a thread for your reference.
Search-Mailbox
http://technet.microsoft.com/en-us/library/dd298173(v=exchg.150).aspx
Hope this can be helpful.
Best regards,
If you have feedback for TechNet Subscriber Support, contact
[email protected]
Amy Wang
TechNet Community Support

Similar Messages

Pulling specific subject with search-mailbox

I'm trying to use search-mailbox in Exchange 2010 to find e-mails with a specific subject, but my query is pullling more than it should. Here's what I've got:
get-mailbox "Userbox" | search-mailbox -searchquery 'Subject:"Your e-mail will expire soon!"' -targetmailbox "adminbox" -targetfolder "adminfolder"
It's finding the e-mails I'm looking for, but it's also pulling e-mails with subjects like "Your driver's license will expire soon" and "Contracts for your review". How do I get the exact phrase? Right now, it looks like it's
OR-ing each word.
Thanks,
Matthew

Hi,
As the link mentioned which was provided by troy:
http://help.outlook.com/en-us/140/ms.exch.ecp.newmailboxsearch_searchquery.aspx
Exact phrases
Use double quotation marks ( " ) to search for exact terms or phrases. For example, "cat and dog" finds messages that contain the exact phrase
cat and dog. The search cat AND dog finds messages that contain both words somewhere in the message. Exact phrases can help you obtain more precise results.
In addition,according to your requirement,you can try the following command:
Search-Mailbox -Identity Usermailbox -SearchQuery 'Subject:"your e-mail will expire soon!" And From:[email protected]' -Targetmailbox adminbox -Targetfolder adminfolder
Hope this hleps!
Thanks.
Niko Cheng
TechNet Community Support

Search-Mailbox -deletecontent...not deleting all items?

Hi, I am trying to purge some data from my Exchange server. I am running:
Search-Mailbox -id username -searchquery "system.message.datareceived:01/01/2011..01/09/2011" -DeleteContent
The first time I ran this against a mailbox it went off and deleted a load of mail. But looking into things further, there is still lots of mail that was received in the period stated. Not sure why the cmd hasn;t got rid of this as well? Also tried system.message.datesent
but again when I run this the log states that there is nothing to delete, even though I have over 200 emails from June-Sept. Whats the deal here?

Hi,
Please try the following command and check:
Search-Mailbox -Identity <username> -SearchQuery "Received:> $('01/01/2011 00:00:00') and Received:< $('01/09/2011 23:59:59')"
–DeleteContent
Hope it helps. If this issue still occurs, please let us know.
Thanks
Sophia Xu
TechNet Community Support

Searching for calendar items older than a specific date with search-mailbox and AQS

I need to find the total size of all calendar items in a mailbox older than a specified date using PowerShell through the search-mailbox cmdlet's searchquery parameter. My problem is that I cannot find a complete list of Calendar item properties to
use in search queries. The AQS page doesn't have a complete list of properties for a Calendar object.
I'm using code from the ArchiveStatisticsPlanner.ps1 script as a base and the only date properties I know of are the sent and receive properties (see below.) The basic start, end, date properties generate errors in the query. How can I find all
Calendar items older than say, 1/1/2013?
Sample:
$MBXSearch=Search-Mailbox-Identity$MBX-SearchQuery"kind:calendar
sent:<=$QueryDate OR kind:calendar received:<=$QueryDate"-EstimateResultOnly-DoNotIncludeArchive

huh, you a get response marked as answer that wasn't very helpful.
EDIT: and now I'm reported as abusive. Please don't tell the truth on these forums, it seems to be frowned upon
I did that.
If you're going to necro an answered thread and attempt to hijack it, you should have an actual answer that you feel is more relevant.
All you did was complain and add zero useful information, thus earning an 'offtopic/irrelevant' notation.
Don't retire TechNet! -
(Don't give up yet - 13,085+ strong and growing)

Search-Mailbox -SearchQuery not filtering time correctly

After reading: http://technet.microsoft.com/en-us/library/dd298173(v=exchg.150).aspx
which links off to: http://msdn.microsoft.com/library/ee558911%28v=office.15%29.aspx
I made the following PowerShell script for testing before I start deleting anything:
$A=Get-Date '18/7/2014'
$Start=Get-Date $A.ToUniversalTime() -Format yyyy-MM-ddThh:mm:ss
$End=Get-Date $A.AddDays(1).ToUniversalTime() -Format yyyy-MM-ddThh:mm:ss
$SearchQuery='Received>="'+$Start+'" AND Received<"'+$End+'"'
Search-Mailbox -Identity 'mailbox@domain' -SearchQuery $SearchQuery -TargetMailbox 'targetmailbox@domain' -TargetFolder Inbox -LogOnly -LogLevel Full
The results I get back are all the emails between 17/7/2014 12:00 AM - 18/7/2014 12:00 AM
When I thought it should be the emails between 17/7/2014 2:30 PM - 18/7/2014 2:30 PM (Our time zone is +9:30)
Does the query I'm passing to -SearchQuery need tweaking or am I doing something else wrong?
The $SearchQuery variable expands out to this:
Received>="2014-07-17T02:30:00" AND Received<"2014-07-18T02:30:00"
I'm using the Search-Mailbox cmdlet because is wish to adjust this script to use the -DeleteContent paramater

Hi,
I recommend you post this in
Powershell Forum also, as they should have more professional knowledge on scripting and you may get effective solution timely.
Thanks.
Niko Cheng
TechNet Community Support

Search-Mailbox limitations

I have an Exchange Server 2010 mailbox which receives alert messages on the order of 800,000+ a day. I am working on getting the developers to change their code, but in the meantime, I am looking for ways to clear out the mailbox. I have
a Search-Mailbox script with the -deletecontent switch that works, but there appears to be an upper limit on the number of messages it can handle. Based on my experience the upper limit lies between 300,000 (my script does work here) and 690,000 (my
script does not work at this level).
I have tried using a Retention Policy, but that didn't work either. I am currently looking at the following options:
1) Put in an Inbox Rule that permanently deletes the error messages.
2) Investigate using a Transport Rule.
3) Letting the mailbox fill up again and let the Developers get the message that they need to clean up their code. - my favorite as I believe anything else is just enabling bad behavior.
Thoughts?
TIA
Nate
nc

Hi,
In your case, you can create Inbox rule or transport rule to delete these messages.
From my point of veiw, you need to figure out the root cause of this issue why this mailbox receives a large amount of alert messages.
You can check the application log to see if there is any related events.
Best regards,
If you have feedback for TechNet Subscriber Support, contact
[email protected]
Belinda Ma
TechNet Community Support

Search-Mailbox -identity & DeleteContent

Hi. I ran powershell scripts on a users mailbox (test lab):
Search-Mailbox -identity 'user name' -SearchQuery '(received:01/02/2003..21/01/2014) AND (kind:email)' -DeleteContent
Search-Mailbox -identity 'user name' -SearchQuery '(received:01/02/2003..21/01/2014 AND (kind:meetings)' -DeleteContent
When I compared the results post script execution 'Test-Lab Vs Production' the email retained in the Test Lab mailbox were not as expected.
9 Emails remained in the users Mailbox. Received date varied. The 4 dated 22/01/2014 were expected. The additional 5 were not. I would have expected these to have been deleted.
22/01/2014 x 4
23/09/2013 * 1
10/04/2013 x 1
02/01/2013 x 1
06/12/2012 x 1
22/01/2012 x 1
The script to remove calendar appointments appears to have deleted ALL appointment's (future > 2101/2014).
Is anybody able to shed some light as to why I am seeing the results that I am?
Kind Regards,
Phil.
IT Manager

Hi,
I recommend you using the following command to delete a specific email you mentioned above that was not deleted to check if the email could be deleted.
search-mailbox -identity username -searchquery subject:'emailsubject' -deletecontent
Best regards,
Belinda
Belinda Ma
TechNet Community Support

Search-Mailbox Search Query not returning correct results.

Hi,
I'd appreciate some assistance with the search and delete I'm trying to I'm run.
I'm using the following command to find messages with a certain message class received before 01/01/14 in a mailbox.
Get-Mailbox xxxxxxxxxxxxxxx | Search-Mailbox -SearchQuery '(Received:< 01/01/14) AND ("IPM.Note.Worksite.Ems.Filed")' -EstimateResultOnly | select displayname, success, resultitemscount,Resultitemssize
When I first ran the command it returned 130,000 items, I ran it again with a -DeleteContent switch, all the items were successfully removed from the mailbox, great! However, when I look in the mailbox I can see ~1000 items with the message class in the command
and dated 2013 or earlier, they meet the search criteria so I don't understand why when I run the command again it returns 0 items.
Help!

Hello,
Based on your description, your cmdlet is ok.
When you run the cmdlet with a -DeleteContent switch, the messages are not delete permanently. please try to run the cmdlet with a -DeleteContent switch and -Force switch to check the result.
Besides, please use get-mailboxstatistics | fl cmdlet to check information about mailbox.
Cara Chen
TechNet Community Support

PowerShell Search-Mailbox cmdlet filtering language differences: AQS, KQL, FQL

In Exchange 2010, Search-Mailbox uses AQS as the filtering language. We're preparing to move to Exchange 2013 and want to make sure that the processes we used to search for particular types of emails gets updated before-hand. Initially when we
were looking at Exchange 2013, it appears Search-Mailbox changes to use KQL/FQL (??) so we assumed this would break the search filters we've already written for Search-Mailbox. However, after looking at the syntax for KQL, it looks nearly identical to
AQS and it appears the queries we have written using AQS filters may natively work in Ex2013 with KQL -- can anyone confirm or deny this? If so, it would seem a very close familial language structure between the two (AQS/KQL) but I was unable to find
any documentation on technet connecting them. Does anyone know of any documentation that discusses the move of filtering languages and the deltas them?
TIA.

Hi,
The Advanced Query Syntax (AQS) and Keyword Query Language (KQL), they are two different query languages for different Exchange versions, even though KQL is similar to AQS.
I searched from internal channel, there may be some restrictions when you use
AQS query in Exchange 2013.
I recommend modify your search filters after you migrate to Exchange 2013.
Best regards,
Belinda Ma
TechNet Community Support

Search-Mailbox for Message Header Content in Management Shell

Can I use the search-mailbox command to search for message header content?
The reason I ask is because I need to search for any emails that came in to an email alias address.
I am searching a journaling mailbox.
Normally, I would do soemthing like...
Search-Mailbox -Identity "journalbox" -SearchQuery '"To: [email protected]"' -TargetMailbox "exportbox" -TargetFolder "exported_messages"
The problem is, because I'm looking to find the emails coming to [email protected], when the messages are journaled they appear as "To: [email protected]" in the journaled envelop message.
In this scenario if I could simply search header content for the email ([email protected]) that would accomplish what I need.

Hi,
We can use the Search-Mailbox cmdlet to search messages in a specified mailbox and perform any of the following tasks:
Copy messages to a specified target mailbox.
Delete messages from the source mailbox.
Copy messages from the source mailbox and delete them from the target mailbox.
Perform single item recovery to recover items from a user's Recoverable Items folder.
Clean up the Recoverable Items folder for a mailbox when it has reached the Recoverable Items hard quota.
To search for message header content, we can use Get-MessageTrackingLog cmdlet.
Here is an article for reference:
http://exchangeserverpro.com/exchange-2010-message-tracking-log-search-powershell/
Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety,
or suitability of any software or information found there. Please make sure that you completely understand the risk before retrieving any suggestions from the above link.
Best Regards.

Search-Mailbox + date output

Hey guys,
I'm up to create a very small reporting for our helpdesk mailbox. At the moment just the number of received emails per day is needed.
search-mailbox helpdesk -targetmailbox AdminSearchMailbox -targetfolder "search results" -searchquery "received:today" -LogOnly -LogLevel full | export-csv c:\test.csv
-append
I would create a scheduled task which runs the command at the end of the day.
This works quite fine so far, but I want to add the current date in each row.
I just tried to pipe get-date even with a variable.
Have you got any idea how to solve this?
Kind regrads,
Christian

Search-Mailbox is only going to give you the count of the number of messages that are currently in the mailbox (whether they were delivered, copied, or dragged from another mailbox) - it will not tell you how many have been delivered to it. It is also
overkill if all you need is the information about the messages, but not really the messages themselves. Additionally, the search as you have it laid out will not only show you what was sent into the mailbox, but also what was sent from it (since messages
sent from the mailbox will show up in the "received:today" part of your query).
In your situation, I recommend using Get-MessageTrackingLog searches, since they will give you exactly what was delivered into a mailbox, regardless of whether it still exists in the mailbox or not. And it will give you the information about the messages
without burdening you with the messages themselves. For your case, I'd run the following daily:
$Today = Get-Date (Get-Date -Format MM/dd/yyyy)
$Yesterday = $Today.AddDays(-1)
Get-TransportServer | Sort Name | % {
Get-MessageTrackingLog -Recipients:<smtp address of helpdesk mailbox> -Start $Yesterday -End $Today -Server $_.Name
} | Select TimeStamp, Sender, @{E={ "$($_.Recipients)" };L='Recipients'}, MessageSubject, EventID, TotalBytes, RecipientCount, `
@{E={ "$($_.RecipientStatus)" };L='RecipientStatus'}, ServerHostName, MessageLatency*, ConnectorID, MessageID
I've split the Select statement at the end for readability. This short script should give you the full information about the messages received into this mailbox for all of yesterday (midnight to midnight), without actually requiring storage to
hold all the messages. Oh, and the TimeStamp field of each row will show you what date everything happened, which gives you the information about date that you are currently missing.

Searching for phrases which include quotation marks

I'm trying to find a way to do searches for phrases which include quotation marks. This has proved impossible, since quotation marks are needed to frame the search, such as:
"this is the phrase I'm looking for"
But what if I want to find a phrase such as:
and then he said, "Have a nice day," and I laughed
In another thread I found a reference to a raw query search, which allows for case-sensitive searching:
https://discussions.apple.com/message/12692997#12692997
The example of:
kMDItemTextContent == "THIS TEXT AS IT APPEARS HERE"dw
Is part of what I'm trying to do, except I also want to include a quote.
Any ideas?
Thanks!

According to "File Metadata Query Expression Syntax",
Characters such as " and ‘ in the value string should be escaped using the \ character.
So your raw query should be
kMDItemTextContent == "and then he said, \"Have a nice day,\" and I laughed"
…However, there is a wrinkle. I tested it on a text file containing the string
a problem ("the perpetrator gained access
The query
kMDItemTextContent == "\"the perpetrator gained access"
should find it—but doesn't. However, the query
kMDItemTextContent == "(\"the perpetrator gained access"
does find it.
So either I don't know how to use this, or the syntax is buggy, and, in certain circumstances, \ is not interpreted as a metacharacter.

Search-Mailbox Question

I would like to know if there is a way when doing a search-mailbox for "ALL" mailboxes in Exchange 2010, to make all results show in one single folder.
Further explanation, We want to use -TargetFolder, however, I don't want the results to show up in "SubFolders" under the Target folder for each mailbox. I would like ALL results in on "Single" folder.
Is this possible?
Thanks

Hi,
We have to specify an target folder and target mailbox when using Search-Mailbox command.
Please try following command to search mailbox and specify target mailbox and folder, for example mailbox One and folder Test.
Get-Mailbox | Search-Mailbox -SearchQuery 'Delivery has failed' -TargetMailbox "One" -TargetFolder "Test" -LogOnly -LogLevel Full
If you don’t add “-LogOnly”, it will search all mailbox and create subfolder for each mailbox under the target folder.
More details about Search-Mailbox, please refer to blew link:
http://technet.microsoft.com/en-us/library/dd298173(v=exchg.141).aspx
“The LogOnly switch specifies that a search be performed and only a log be generated. Messages returned by the search aren't copied to the target mailbox. The logging level is specified by using the LogLevel parameter.”
I hope it will help you.
Best Regards,
Allen Wang

Move the discovery search mailbox

Hi
Is there a way to move the default Discovery Search Mailbox from one database to another? Or do I have to delete the one I have and create a new on in another database?
Pittbull

Is the user that you're logged in as part of the "Organization Management" group in AD? I had to add myself to that before I could manage anything in the EMC or Powershell.
Also, not sure where I found these, but I ended up running these commands in PS to move the built-in mailboxes from the database that Exchange 2010 setup made to ones that I created later.
get-mailbox -Database "Mailbox Database 0237090912" | New-MoveRequest -TargetDatabase "TARGETDATABASENAME”
get-mailbox -Database "Mailbox Database 0237090912" -arbitration | New-MoveRequest -TargetDatabase "TARGETDATABASENAME”
Where "Mailbox Database 0237090912" is the database Exchange 2010 made and "TARGETDATABSE" is the database you're moving everything to.
P.S. I thought I'd add that I got this info from this site:
http://www.howexchangeworks.com/2009/11/error-while-deleting-default-mailbox.html
The first get-mailbox command actually moves all of the mailboxes (including Discovery) from the first database to the second. The second command does the same thing for all of the arbitration mailboxes.

-DeleteContent switch for Search-Mailbox Cmdlet does not work

Apologies if this isn't the right forum for this question.
I'm having trouble with the Search-Mailbox cmdlet, specifically when I'm attempting to use the -DeleteContent switch in order to delete a message from a specific user's mailbox.
I attempt to run the command:
Search-Mailbox -identity "Some User" -DeleteContent -SearchQuery 'Subject:"Spam Email Subject Heading"'
And I get:
A positional parameter cannot be found that accepts argument '-DeleteContent'.
+ CategoryInfo : InvalidArgument: (:) [Search-Mailbox], ParameterBindingException
+ FullyQualifiedErrorId : PositionalParameterNotFound,Search-Mailbox
Any idea what could be causing this issue? It's as if the shell does not recognize the existence of the -DeleteContent switch. I have no issues at all with the Search-Mailbox cmdlet except when it comes to using that switch.
Some background:
- Yes, I am running the shell as an admin.
- I'm running EMS on my Exchange server itself through an RDS instance.
- Running Exchange Server 2010 - Version: 14.03.0181.006
- My user account is a member of: Discovery Management, Organization Management, Recipient Management, Records Management, Server Management, and UM Management.
Thank you in advance for any help any of you can provide!

The exchange blog team has contained
here with good explanation in detail about removing the specific user mailbox in exchange 2010. Please check this.

Search-mailbox phrase

Similar Messages

Maybe you are looking for