Export (0) Print
Expand All

Reduce the size of a discovery mailbox in Exchange

Exchange Online
 

Applies to: Exchange Server 2013, Exchange Online

Topic Last Modified: 2014-05-30

Have a discovery mailbox that’s exceeded the 50 GB limit? You can fix this issue by creating new discovery mailboxes and copying the search results from the large discovery mailbox to the new ones.

In Exchange Server 2013 and Exchange Online, the maximum size of discovery mailboxes, which are used to store In-Place eDiscovery search results, is 50 GB. Prior to the current size limit, you were able to increase the storage quota to more than 50 GB, which resulted in having discovery mailboxes much larger than 50 GB. There are three issues with discovery mailboxes that are larger than 50 GB:

  • They’re not supported.

  • They can’t be migrated to Office 365.

  • If they’re discovery mailboxes in Exchange Server 2010, they can’t be upgraded to Exchange Server 2013.

Here’s a quick look at what you’ll need to do to reduce the size of a discovery mailbox that’s exceeded the 50 GB limit:

  1. Create additional discovery mailboxes to distribute the search results to.

  2. Copy the search results from the existing discovery mailbox to one or more of the new discovery mailboxes.

  3. Delete eDiscovery searches from the original discovery mailbox to reduce its size.

The strategy presented here groups the search results from the original discovery mailbox into separate eDiscovery searches that are based on date ranges. This is a quick way to copy many search results to a new discovery mailbox. The following graphic illustrates this approach.

Reducing the size of a discovery mailbox

  • Estimated time to complete this task: Time will vary based on the amount and size of the search results that will be copied to different discovery mailboxes.

  • Run the following command to determine the size of the discovery mailboxes in your organization.

    Get-Mailbox -RecipientTypeDetails DiscoveryMailbox | Get-MailboxStatistics | FL DisplayName,TotalItemSize
    
  • Determine if you need to keep some or all of the search results from the discovery mailbox that’s exceeded the 50 GB limit. Follow the steps in this topic to retain search results by copying them to a different discovery mailbox. If you don’t need to keep the results of a specific eDiscovery search, you can delete the search, as explained in step 3. Deleting a search will delete the search results from the discovery mailbox.

  • If you don’t need any of the search results from a discovery mailbox that’s exceeded the 50 GB limit, you can delete it. If this is the default discovery mailbox that was created when your Exchange organization was provisioned, you can re-create it. For more information, see Delete and re-create the default discovery mailbox in Exchange.

  • For current legal cases, you might want to export the results of selected eDiscovery searches to .pst files. Doing this keeps the results from a specific search intact. In addition to the .pst files that contain the search results, a search results log (.csv file format) that contains an entry for each message returned in the search results is also exported. Each entry in this file identifies the source mailbox where the message is located. For more information, see Export eDiscovery search results to a PST file.

    After you export search results to .pst files, you’ll need to use Outlook if you want to import them to a new discovery mailbox.

The first step is to create additional discovery mailboxes so that you can copy the search results from the discovery mailbox that’s exceeded the size limit. Based on the 50 GB size limit for discovery mailboxes, determine how many additional discovery mailboxes you’ll need and create them. You’ll then need to assign users or groups the necessary permissions to open these new discovery mailboxes.

  1. Run the following command to create a new discovery mailbox.

    New-Mailbox -Name <discovery mailbox name> -Discovery
    
  2. Run the following command to assign a user or group permissions to open the discovery mailbox and view search results.

    Add-MailboxPermission <discovery mailbox name> -User <name of user or group> -AccessRights FullAccess -InheritanceType all
    

The next step is to use the New-MailboxSearch cmdlet to copy the search results from the existing discovery mailbox to a new discovery mailbox that you created in the previous step. This procedure uses the StartDate and EndDate parameters to scope the search results into batches that are no larger than 50 GB. This may require some testing (by estimating the search results) to size the search results appropriately.

  1. Run the following command to create a new eDiscovery search.

    New-MailboxSearch -Name "Search results from 2010" -SourceMailboxes "Discovery Search Mailbox" -StartDate "01/01/2010" -EndDate "12/31/2010" -TargetMailbox "Discovery Mailbox Backup 01" -EstimateOnly -StatusMailRecipients admin@contoso.com
    

    This example uses the following parameters:

    • Name   This parameter specifies the name of the new eDiscovery search. Because the search is scoped by sent and received dates, it’s useful that the name of the search includes the date range.

    • SourceMailboxes   This parameter specifies the default discovery mailbox. You can also specify the name of another discovery mailbox that’s exceeded the size limit.

    • StartDate and EndDate   These parameters specify the date range of the search results in the default discovery mailbox to include in the search results.

      NoteNote:
      For dates, use the short date format, mm/dd/yyyy, even if the Regional Options settings on the local computer are configured with a different format, such as dd/mm/yyyy. For example, use 03/01/2014 to specify March 1, 2014.
    • TargetMailbox   This parameter specifies that search results should be copied to the discovery mailbox named "Discovery Mailbox Backup 01".

    • EstimateOnly   This switch specifies that only an estimate of the number of items that will be returned is provided when the search is started. If you don’t include this switch, messages are copied to the target mailbox when the search is started. Using this switch lets you adjust the date ranges if necessary to increase or decrease the number of search results.

    • StatusMailRecipients   This parameter specifies that the status message should be sent to the specified recipient.

  2. After the search is created, start it by using the Shell or the Exchange admin center (EAC).

    • Using the Shell: Run the following command to start the search created in the previous step. Because the EstimateOnly switch was included when the search was created, the search results won’t be copied to the target discovery mailbox.

      Start-MailboxSearch "Search results from 2010"
      
    • Using the EAC: Go to Compliance management > In-Place eDiscovery & hold. Select the search created in the previous step, click Search Search icon, and then click Estimate search results.

  3. If necessary, adjust the date range to increase or decrease the amount of search results that are returned. If you change the date range, run the search again to get a new estimate of the results. Consider changing the name of the search to reflect the new date range.

  4. When you’re finished testing the search, use the Shell or the EAC to copy the search results to the target discovery mailbox.

    • Using the Shell: Run the following commands to copy the search results. You have to remove the EstimateOnly switch before you can copy the search results.

      Set-MailboxSearch "Search results from 2010" -EstimateOnly $false
      
      Start-MailboxSearch "Search results from 2010"
      
    • Using the EAC: Go to Compliance management > In-Place eDiscovery & hold. Select the search, click Search Search icon, and then click Copy search results.

    For more information, see Copy eDiscovery search results to a discovery mailbox.

  5. Repeat steps 1 through 4 to create new searches for additional date ranges. Include the date range in the name of the new search to indicate the range of the results. To make sure none of the discovery mailboxes exceeds the 50 GB limit, use different discovery mailboxes as the target mailbox.

After you’ve copied search results from the original discovery mailbox to another discovery mailbox, you can delete the original eDiscovery searches. Deleting an eDiscovery search will delete the search results from the discovery mailbox where those search results are stored.

Before deleting a search, you can run the following command to identify the size of the search results that have been copied to a discovery mailbox for all searches in your organization.

Get-MailboxSearch | FL Name,TargetMailbox,ResultSizeCopied

You can use the Shell or the EAC to delete an eDiscovery search.

  • Using the Shell: Run the following command.

    Remove-MailboxSearch -Identity <name of search>
    
  • Using the EAC: Go to Compliance management > In-Place eDiscovery & hold. Select the search that you want to delete, and then click Delete Delete icon.

After you’ve deleted the eDiscovery searches to remove the results from the discovery mailbox where they were stored, run the following command to display the size of a selected discovery mailbox.

Get-Mailbox <name of discovery mailbox> | Get-MailboxStatistics | FL TotalItemSize
 
Was this page helpful?
(1500 characters remaining)
Thank you for your feedback
Show:
© 2014 Microsoft