New-MailboxSearch
Applies to: Exchange Online, Exchange Server 2016
Topic Last Modified: 2017-02-27
This cmdlet is available in on-premises Exchange Server 2016 and in the cloud-based service. Some parameters and settings may be exclusive to one environment or the other.
Note: |
|---|
| On July 1, 2017, you'll no longer be able to use the New-MailboxSearch cmdlet to create In-Place eDiscovery searches and In-Place Holds in Exchange Online. To create eDiscovery searches and eDiscovery case holds, please start using New-ComplianceSearch and New-CaseHoldPolicy in the Office 365 Security & Compliance Center. You'll still be able to use Set-MailboxSearch to modify existing In-Place eDiscovery searches and In-Place Holds. Creating new searches and holds in Exchange Server 2013 will still be supported, and searches run from your on-premises organization in an Exchange hybrid deployment aren't affected by this change. |
Use the New-MailboxSearch cmdlet to create a mailbox search and either get an estimate of search results, place search results on In-Place Hold or copy them to a Discovery mailbox. You can also place all contents in a mailbox on hold by not specifying a search query, which accomplishes similar results as Litigation Hold.
Caution: |
|---|
| By default, mailbox searches are performed across all Exchange 2016 and Exchange 2013 Mailbox servers in an Exchange organization, unless you constrain the search to fewer mailboxes by using the SourceMailboxes parameter. To search mailboxes on Exchange 2010 Mailbox servers, run the command on an Exchange 2010 server. |
For more information, see In-Place eDiscovery in Exchange 2016 and In-Place Hold and Litigation Hold in Exchange 2016.
For information about the parameter sets in the Syntax section below, see Exchange cmdlet syntax.
New-MailboxSearch -Name <String> [-AllPublicFolderSources <$true | $false>] [-AllSourceMailboxes <$true | $false>] [-Confirm [<SwitchParameter>]] [-Description <String>] [-DomainController <Fqdn>] [-EndDate <ExDateTime>] [-EstimateOnly <SwitchParameter>] [-ExcludeDuplicateMessages <$true | $false>] [-Force <SwitchParameter>] [-IncludeKeywordStatistics <SwitchParameter>] [-IncludeUnsearchableItems <SwitchParameter>] [-InPlaceHoldEnabled <$true | $false>] [-InPlaceHoldIdentity <String>] [-ItemHoldPeriod <Unlimited>] [-Language <CultureInfo>] [-LogLevel <Suppress | Basic | Full>] [-MessageTypes <KindKeyword[]>] [-PublicFolderSources <PublicFolderIdParameter[]>] [-Recipients <String[]>] [-SearchQuery <String>] [-Senders <String[]>] [-SourceMailboxes <RecipientIdParameter[]>] [-StartDate <ExDateTime>] [-StatusMailRecipients <RecipientIdParameter[]>] [-TargetMailbox <MailboxIdParameter>] [-WhatIf [<SwitchParameter>]]
This example creates the mailbox search Legal-ProjectX. The search uses several parameters to restrict the search query:
-
SourceMailboxes This parameter restricts the search to members of the DG-Marketing and DG-Executives distribution groups.
-
Recipients This parameter specifies that the search includes all mail sent to the domain contoso.com.
-
SearchQuery This parameter specifies a KQL query for messages with either the words project or report and for messages with attachments.
-
StartDate and EndDate These parameters specify the start date of January 1, 2015, and end date of December 31, 2015, for the search.
-
TargetMailbox This parameter specifies that search results should be copied to the discovery mailbox LegalDiscovery.
-
StatusMailRecipeints This parameter specifies that the distribution group DG-DiscoveryTeam is to receive a notification when the search is complete.
New-MailboxSearch -Name "Legal-ProjectX" -SourceMailboxes DG-Marketing,DG-Executives -TargetMailbox LegalDiscovery@contoso.com -StartDate "01/01/2015" -EndDate "12/31/2015" -Recipients "@contoso.com" -SearchQuery "project report hasattachments:true" -StatusMailRecipients "DG-DiscoveryTeam"
This example creates an In-Place Hold Hold-ProjectX and places all members of the distribution group DG-Finance on hold. Because the search doesn't specify the SearchQuery and ItemHoldPeriod parameters, all messages in mailboxes returned are placed on indefinite In-Place Hold.
New-MailboxSearch -Name "Hold-ProjectX" -SourceMailboxes DG-Finance -InPlaceHoldEnabled $true
This example creates an In-Place Hold Hold-tailspintoys and places all members of the distribution group DG-Research on hold. Because the search specifies the SearchQuery parameter, only messages that match the search query are placed on indefinite In-Place Hold.
New-MailboxSearch -Name "Hold-tailspintoys" -SourceMailboxes DG-Research -SearchQuery "'Patent' AND 'Project tailspintoys'" -InPlaceHoldEnabled $true
In on-premises Exchange, this example creates an In-Place Hold named Hold for all PFs that places all content in all public folders on In-Place hold, with an unlimited hold duration.
New-MailboxSearch -Name "Hold for all PFs" -AllPublicFolderSources $true -InPlaceHoldEnabled $true
The New-MailboxSearch cmdlet creates an In-Place eDiscovery search or an In-Place Hold. Unless specified, mailboxes on all Mailbox servers in an organization are searched. You can stop, start, modify, or remove the search.
You need to be assigned permissions before you can run this cmdlet. Although all parameters for this cmdlet are listed in this topic, you may not have access to some parameters if they're not included in the permissions assigned to you. To see what permissions you need, see the "In-Place eDiscovery" and "In-Place Hold" entries in the Messaging policy and compliance permissions in Exchange 2016 topic.
| Parameter | Required | Type | Description | ||
|---|---|---|---|---|---|
| Name | Required | System.String | The Name parameter specifies a friendly name for the search. If the value contains spaces, enclose the value in quotation marks ("). The value of this parameter is used to create the top-level folder that holds the search results in the target mailbox that's specified by the TargetMailbox parameter. | ||
| AllPublicFolderSources | Optional | System.Boolean | This parameter is available only in on-premises Exchange 2016. The AllPublicFolderSources parameter specifies whether to include all public folders in the organization in the search. Valid values are:
| ||
| AllSourceMailboxes | Optional | System.Boolean | This parameter is available only in on-premises Exchange 2016. The AllSourceMailboxes parameter specifies whether to include all mailboxes in the search. Valid values are:
| ||
| Confirm | Optional | System.Management.Automation.SwitchParameter | The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on if the cmdlet requires confirmation before proceeding.
| ||
| Description | Optional | System.String | The Description parameter specifies a description for the search. The description isn't displayed to users. If the value contains spaces, enclose the value in quotation marks ("). | ||
| DomainController | Optional | Microsoft.Exchange.Data.Fqdn | This parameter is available only in on-premises Exchange 2016.
The DomainController parameter specifies the domain controller that's used by this cmdlet to read data from or write data to Active Directory. You identify the domain controller by its fully qualified domain name (FQDN). For example, | ||
| EndDate | Optional | Microsoft.Exchange.ExchangeSystem.ExDateTime | The EndDate parameter specifies the end date of the date range. Use the short date format that's defined in the Regional Options settings on the computer where you're running the command. For example, if the computer is configured to use the short date format mm/dd/yyyy, enter 09/01/2015 to specify September 1, 2015. You can enter the date only, or you can enter the date and time of day. If you enter the date and time of day, enclose the value in quotation marks ("), for example, "09/01/2015 5:00 PM". | ||
| EstimateOnly | Optional | System.Management.Automation.SwitchParameter | The EstimateOnly switch specifies that only an estimate of the number of items that will be returned is provided. You don't need to specify a value with this switch. If you don't use this switch, messages are copied to the target mailbox. | ||
| ExcludeDuplicateMessages | Optional | System.Boolean | The ExcludeDuplicateMessages parameter eliminates duplication of messages in search results. Valid values are:
| ||
| Force | Optional | System.Management.Automation.SwitchParameter | The Force switch specifies whether to suppress warning or confirmation messages. You can use this switch to run tasks programmatically where prompting for administrative input is inappropriate. You don't need to specify a value with this switch. | ||
| IncludeKeywordStatistics | Optional | System.Management.Automation.SwitchParameter | The IncludeKeywordStatistics switch returns keyword statistics (number of instances for each keyword) in search results. You don't need to specify a value with this switch. | ||
| IncludeUnsearchableItems | Optional | System.Management.Automation.SwitchParameter | The IncludeUnsearchableItems switch specifies that items that couldn't be indexed by Exchange Search should be included in the results. You don't need to specify a value with this switch.
| ||
| InPlaceHoldEnabled | Optional | System.Boolean | The InPlaceHoldEnabled parameter specifies whether to set an In-Place Hold on items in the search results. Valid values are:
You can't set an In-Place Hold on the search results when the AllSourceMailboxes parameter is
| ||
| InPlaceHoldIdentity | Optional | System.String | This parameter is reserved for internal Microsoft use. | ||
| ItemHoldPeriod | Optional | Microsoft.Exchange.Data.Unlimited | The ItemHoldPeriod parameter specifies the number of days for the In-Place Hold onthe mailbox items (all mailbox items or the items that are returned in the search query results). The duration is calculated from the time the item is received or created in the mailbox. Valid values are:
| ||
| Language | Optional | System.Globalization.CultureInfo | The Language parameter specifies a locale for the search.
Valid input for this parameter is a supported culture code value from the Microsoft .NET Framework CultureInfo class. For example, | ||
| LogLevel | Optional | Microsoft.Exchange.Data.Storage.Infoworker.MailboxSearch.LoggingLevel | The LogLevel parameter specifies the logging level for the search. Valid values are:
| ||
| MessageTypes | Optional | Microsoft.Exchange.Data.Search.AqsParser.KindKeyword[] | The MessageTypes parameter specifies the message types to include in the search query. Valid values are:
You can specify multiple values separated by commas.
The default value is blank ( | ||
| PublicFolderSources | Optional | Microsoft.Exchange.Configuration.Tasks.PublicFolderIdParameter[] | This parameter is reserved for internal Microsoft use. | ||
| Recipients | Optional | System.String[] | The Recipients parameter specifies one or more recipients to include in the search query. Messages that have the specified recipients in the To, Cc, and Bcc fields are returned in the search results. You can specify multiple recipients separated by commas. | ||
| SearchQuery | Optional | System.String | The SearchQuery parameter specifies keywords for the search query by using the Keyword Query Language (KQL). For more information about KQL, see Keyword Query Language syntax reference. If you use this parameter with other search query parameters, the query combines these parameters by using the AND operator. The other search query parameters are:
| ||
| Senders | Optional | System.String[] | The Senders parameter specifies one or more senders to include in the search query. Messages that have the specified sender are returned in the search results. Senders can include users, distribution groups (messages sent by members of the group), SMTP addresses, or domains. You can specify multiple senders separated by commas. If the value contains spaces, enclose the value in quotation marks ("). | ||
| SourceMailboxes | Optional | Microsoft.Exchange.Configuration.Tasks.RecipientIdParameter[] | The SourceMailboxes parameter specifies the identity of one or more mailboxes to be searched. You can use any value that uniquely identifies the mailbox. For example:
You can specify multiple values separated by commas. To use this parameter, the AllSourceMailboxes parameter needs to be The default value is blank (
| ||
| StartDate | Optional | Microsoft.Exchange.ExchangeSystem.ExDateTime | The StartDate parameter specifies the start date of the date range. Use the short date format that's defined in the Regional Options settings on the computer where you're running the command. For example, if the computer is configured to use the short date format mm/dd/yyyy, enter 09/01/2015 to specify September 1, 2015. You can enter the date only, or you can enter the date and time of day. If you enter the date and time of day, enclose the value in quotation marks ("), for example, "09/01/2015 5:00 PM". | ||
| StatusMailRecipients | Optional | Microsoft.Exchange.Configuration.Tasks.RecipientIdParameter[] | The StatusMailRecipients parameter specifies one or more recipients to receive a status email message upon completion of the search. You can use any value that uniquely identifies the recipient. For example:
You can specify multiple values separated by commas. | ||
| TargetMailbox | Optional | Microsoft.Exchange.Configuration.Tasks.MailboxIdParameter | The TargetMailbox parameter specifies the destination mailbox where the search results are copied. You can use any value that uniquely identifies themailbox. For example:
| ||
| WhatIf | Optional | System.Management.Automation.SwitchParameter | The WhatIf switch simulates the actions of the command. You can use this switch to view the changes that would occur without actually applying those changes. You don't need to specify a value with this switch. |
To see the input types that this cmdlet accepts, see Cmdlet Input and Output Types. If the Input Type field for a cmdlet is blank, the cmdlet doesn’t accept input data.
To see the return types, which are also known as output types, that this cmdlet accepts, see Cmdlet Input and Output Types. If the Output Type field is blank, the cmdlet doesn’t return data.

Note:
Caution: