1 out of 4 rated this helpful Rate this topic

Search-Mailbox

Applies to: Exchange Server 2010 SP2

Topic Last Modified: 2011-11-16

Use the Search-Mailbox cmdlet to search a mailbox and copy the results to a specified target mailbox, delete messages from the source mailbox, or both.


Search-Mailbox -Identity <MailboxOrMailUserIdParameter> [-Confirm [<SwitchParameter>]] [-DeleteContent <SwitchParameter>] [-DomainController <Fqdn>] [-DoNotIncludeArchive <SwitchParameter>] [-Force <SwitchParameter>] [-IncludeUnsearchableItems <SwitchParameter>] [-SearchDumpster <SwitchParameter>] [-SearchDumpsterOnly <SwitchParameter>] [-SearchQuery <String>] [-WhatIf [<SwitchParameter>]]


Search-Mailbox -Identity <MailboxOrMailUserIdParameter> -TargetFolder <String> -TargetMailbox <MailboxIdParameter> [-Confirm [<SwitchParameter>]] [-DeleteContent <SwitchParameter>] [-DomainController <Fqdn>] [-DoNotIncludeArchive <SwitchParameter>] [-Force <SwitchParameter>] [-IncludeUnsearchableItems <SwitchParameter>] [-LogLevel <Suppress | Basic | Full>] [-LogOnly <SwitchParameter>] [-SearchDumpster <SwitchParameter>] [-SearchDumpsterOnly <SwitchParameter>] [-SearchQuery <String>] [-WhatIf [<SwitchParameter>]]


Search-Mailbox -Identity <MailboxOrMailUserIdParameter> -EstimateResultOnly <SwitchParameter> [-Confirm [<SwitchParameter>]] [-DomainController <Fqdn>] [-DoNotIncludeArchive <SwitchParameter>] [-Force <SwitchParameter>] [-IncludeUnsearchableItems <SwitchParameter>] [-SearchDumpster <SwitchParameter>] [-SearchDumpsterOnly <SwitchParameter>] [-SearchQuery <String>] [-WhatIf [<SwitchParameter>]]

Parameter Required Type Description

EstimateResultOnly

Required

System.Management.Automation.SwitchParameter

The EstimateResultOnly switch specifies that only an estimate of the total number and size of messages returned by the search be provided. Messages aren't copied to the target mailbox. You can't use this switch with the TargetMailbox parameter.

Identity

Required

Microsoft.Exchange.Configuration.Tasks.MailboxOrMailUserIdParameter

The Identity parameter specifies the identity of the mailbox to search.

This parameter accepts the following values:

  • Alias
    Example: JPhilips
  • Canonical DN
    Example: Atlanta.Corp.Contoso.Com/Users/JPhilips
  • Display Name
    Example: Jeff Philips
  • Distinguished Name (DN)
    Example: CN=JPhilips,CN=Users,DC=Atlanta,DC=Corp,DC=contoso,DC=com
  • Domain\Account
    Example: Atlanta\JPhilips
  • GUID
    Example: fb456636-fe7d-4d58-9d15-5af57d0354c2
  • Immutable ID
    Example: fb456636-fe7d-4d58-9d15-5af57d0354c2@contoso.com
  • Legacy Exchange DN
    Example: /o=Contoso/ou=AdministrativeGroup/cn=Recipients/cn=JPhilips
  • SMTP Address
    Example: Jeff.Philips@contoso.com
  • User Principal Name
    Example: JPhilips@contoso.com

TargetFolder

Required

System.String

The TargetFolder parameter specifies a folder name in which search results are saved in the target mailbox. The folder is created in the target mailbox upon execution.

TargetMailbox

Required

Microsoft.Exchange.Configuration.Tasks.MailboxIdParameter

The TargetMailbox parameter specifies the identity of the destination mailbox where search results are copied. You can use the following values:

  • Alias
  • Display name
  • Domain\Account
  • SMTP address
  • DN
  • Object GUID
  • UPN
  • LegacyExchangeDN

When you specify a value for the TargetMailbox parameter, you must also specify the TargetFolder parameter. You can't use this parameter with the EstimateResultOnly switch.

Confirm

Optional

System.Management.Automation.SwitchParameter

The Confirm switch causes the command to pause processing and requires you to acknowledge what the command will do before processing continues. You don't have to specify a value with the Confirm switch.

DeleteContent

Optional

System.Management.Automation.SwitchParameter

The DeleteContent switch specifies that the messages returned by the search be permanently deleted from the source mailbox. When used with the TargetMailbox parameter, messages are copied to the target mailbox and removed from the source mailbox. If you set the logging level for the search to Basic or Full, you must specify a target mailbox and a target folder to place the log in. To delete messages from the source mailbox without copying them to the target mailbox, don't specify the TargetMailbox, TargetFolder, and LogLevel parameters.

Dd298173.important(en-us,EXCHG.141).gifImportant:
Before you use the DeleteContent switch to delete content, we recommend that you test search parameters by using the LogOnly parameter, as shown in Example 2.

DomainController

Optional

Microsoft.Exchange.Data.Fqdn

The DomainController parameter specifies the fully qualified domain name (FQDN) of the domain controller that writes this configuration change to Active Directory.

DoNotIncludeArchive

Optional

System.Management.Automation.SwitchParameter

The DoNotIncludeArchive switch specifies that the user's archive mailbox shouldn't be included in the search. You don't need to specify a value for this switch.

Force

Optional

System.Management.Automation.SwitchParameter

The Force switch overrides the confirmation prompt displayed when your use the DeleteContent switch to permanently delete messages.

IncludeUnsearchableItems

Optional

System.Management.Automation.SwitchParameter

The IncludeUnsearchableItems switch specifies whether to include items that couldn't be indexed by Exchange Search. When set to $true, the IncludeUnsearchableItems switch specifies that items that couldn't be indexed by Exchange Search should be included in the search results.

LogLevel

Optional

Microsoft.Exchange.Data.Storage.Infoworker.MailboxSearch.LoggingLevel

The LogLevel parameter specifies the logging level for the search. It can have one of the following values:

  • Suppress   No logs are kept.
  • Basic   Basic information about the query and who ran it is kept.
  • Full   In addition to the information kept by the Basic log level, the Full log level adds a complete list of search results.

The default log level is Basic.

LogOnly

Optional

System.Management.Automation.SwitchParameter

The LogOnly switch specifies that a search be performed and only a log be generated. Messages returned by the search aren't copied to the target mailbox. The logging level is specified by using the LogLevel parameter.

SearchDumpster

Optional

System.Management.Automation.SwitchParameter

The SearchDumpster parameter specifies whether to search the Recoverable Items folder, which is the storage location in which items deleted from the Deleted Items folder or hard-deleted items are stored until they're purged from the mailbox database. By default, the Recoverable Items folder is always searched. To exclude the folder from the search, set the SearchDumpster switch to $false, for example,-SearchDumpster:$false

SearchDumpsterOnly

Optional

System.Management.Automation.SwitchParameter

The SearchDumpsterOnly switch specifies that only the Recoverable Items folder of the specified mailbox be searched. You can also use this switch with the DeleteContent switch to delete messages from the Recoverable Items folder and reduce the size of the folder.

SearchQuery

Optional

System.String

The SearchQuery parameter specifies a search string or a query formatted using Advanced Query Syntax (AQS).

If this parameter is empty, all messages are returned.

WhatIf

Optional

System.Management.Automation.SwitchParameter

The WhatIf switch instructs the command to simulate the actions that it would take on the object. By using the WhatIf switch, you can view what changes would occur without having to apply any of those changes. You don't have to specify a value with the WhatIf switch.

You can use the Search-Mailbox cmdlet to search messages in a specified mailbox and perform any of the following tasks:

  • Copy messages to a specified target mailbox.
  • Delete messages from the source mailbox. For more details, see Use Mailbox Search to Delete Messages.
  • Copy messages from the source mailbox and delete them from the target mailbox.
  • Perform single item recovery to recover items from a user's Recoverable Items folder. For more details, see Perform Single Item Recovery.
  • Clean up the Recoverable Items folder for a mailbox when it has reached the Recoverable Items hard quota. For more details, see Clean Up the Recoverable Items Folder.

You need to be assigned permissions before you can run this cmdlet. Although all parameters for this cmdlet are listed in this topic, you may not have access to some parameters if they're not included in the permissions assigned to you. To see what permissions you need, see the "Multi-Mailbox Search" entry in the Messaging Policy and Compliance Permissions topic.

To see the input types that this cmdlet accepts, see Cmdlet Input and Output Types. If the Input Type field for a cmdlet is blank, the cmdlet doesn’t accept input data.

To see the return types, which are also known as output types, that this cmdlet accepts, see Cmdlet Input and Output Types. If the Output Type field is blank, the cmdlet doesn’t return data.

Error Description

 

 

This example searches the mailbox of Joe Healy and copies the search results to the DiscoveryMailbox in the folder JoeHealy-ProjectHamilton.

Search-Mailbox -Identity "Joe Healy" -SearchQuery "Subject:Project Hamilton" -TargetMailbox "DiscoveryMailbox" -TargetFolder "JoeHealy-ProjectHamilton" -LogLevel Full 

This example searches April Stewart's mailbox for messages that contain the phrase "Your bank statement" in the subject and logs the result in the SearchAndDeleteLog folder in the administrator's mailbox. Messages aren't copied to the target mailbox.

Search-Mailbox -Identity "April Stewart" -SearchQuery 'Subject:"Your bank statement"' -TargetMailbox "administrator" -TargetFolder "SearchAndDeleteLog" -LogOnly -LogLevel Full

This example searches April Stewart's mailbox for messages that contain the phrase "Your bank statement" in the subject and deletes the messages from the source mailbox.

Search-Mailbox -Identity "April Stewart" -SearchQuery 'Subject:"Your bank statement"' -DeleteContent

This example searches all mailboxes in your organization for messages that contain the words "election", "candidate", or "vote". The search results are copied to the Discovery Search Mailbox in the folder AllMailboxes-Election.

Get-Mailbox | Search-Mailbox -SearchQuery 'election OR candidate OR vote' -TargetMailbox "Discovery Search Mailbox" -TargetFolder "AllMailboxes-Election" -LogLevel Full

Did you find this helpful?
(1500 characters remaining)
Community Content Add
Annotations FAQ
System Messages
Seems like you cannot delete system messages which is a shame. Maybe it could be added in the next SP or release.
-confirm
Hello.
Anyone has an idea how to make -confirm:$false work? I just hit 900x Enter to proceed with message removal from 900 mailboxes.
Exchange 2010 SP1 RU5.
Thank you
Jan
Additional Permissions needed for Parameter -DeleteContent
To be able to use the -DeleteContent Parameter you need to have "Mailbox Import Export" permissions. Without these permissions, the parameter -DeleteContent is not available for the Search-Mailbox Command.
Instructions:
1. Create a new Security Group
2. Enter the following command in Exchange Management Shell (replace the Security Group name accordingly):
New-ManagementRoleAssignment -Name "Import Export Support" -SecurityGroup ImportExport -Role "Mailbox Import Export"
Error Section
Something to add to the error section:

The target mailbox or .pst file path is required.
+ CategoryInfo : InvalidArgument: (:) [], ArgumentException
+ FullyQualifiedErrorId : 780F2AE3

Haven't found a solution to this problem but if I search on the FullyQualifiedErrorID, the Error text and I have found nothing.
-confirm

seems there is a bug regarding the -confim in serach-mailbox with the -deletecontent parameter ! ?