Applies to: Office 365 for enterprises, Live@edu
Topic Last Modified: 2012-02-21
You can use Multi-Mailbox Search in the Exchange Control Panel to search up to 50 mailboxes. But if you’re searching more than 50 mailboxes, you have to use the Search-Mailbox cmdlet in Windows PowerShell. When you use this cmdlet, you can save the search results to the Discovery Search Mailbox.
For more information about searching mailboxes, see:
- Multi-Mailbox Searches
- View Multi-Mailbox Search Results
- Export Multi-Mailbox Search Results to an Outlook Data File (.pst)
Contents
Parameters for the Search-Mailbox cmdlet
Search the mailboxes of lots of users
Search for message sent within a range of dates
E-mail message properties to search
To learn how to install and configure Windows PowerShell and connect to the service, see Use Windows PowerShell in Exchange Online.
The following table describes useful parameters that you can use with the Search-Mailbox cmdlet.
| Parameter | Required or optional | Description |
|---|---|---|
| SearchQuery | Optional | This parameter specifies the keywords to search for or specifies a query formatted using Advanced Query Syntax (AQS). For more information, see: Note If you don’t include this parameter in the search command, all messages from the mailboxes you search will be included in the search results. |
| TargetMailbox | Required | This parameter specifies the discovery mailbox where search results are copied. The default discovery mailbox is named Discovery Search Mailbox. |
| TargetFolder | Required | This parameter specifies the name of a folder in which search results will be saved in the target mailbox. The folder is created in the target mailbox when you run the search. |
| LogLevel | Optional | This parameter specifies the logging level for the search. It can have one of the following values:
If you don’t include the LogLevel parameter, the basic information is kept. |
| EstimateResultOnly | Optional | This switch specifies that only an estimate of the total number and size of messages returned by the search will be provided. Messages aren't copied to the target mailbox. You can't use this switch with the TargetMailbox or TargetFolder parameters. |
For more detailed information about all the parameters that you can use with the Search-Mailbox cmdlet, see Search-Mailbox.
Important There are no parameters supported by the Search-Mailbox cmdlet that let you specify start or end dates to search for messages sent within a specific timeframe. However, you can still search for messages sent within a specific time frame by including an AQS query that searches the Sent property for a specific date range in the value of the SearchQuery parameter. For more information, see Search for message sent within range of dates.
The following sections show examples of ways to use the Search-Mailbox cmdlet to search a large number of mailboxes.
This example searches all mailboxes in your organization for messages that contain the words election, candidate, or vote. The search results are copied to the Discovery Search Mailbox in the folder AllMailboxes-Election.
This example searches the mailboxes of all members in the Full Time Employees distribution group for messages that contain the term "employee handbook". The search results are copied to the Discovery Search Mailbox in the folder AllFTEMailboxes-HRPolicy.
This example searches the mailboxes of all members in the Freshman Class dynamic distribution group for messages that contain the term "tuition increase" in the Subject line. The search results are copied to the Discovery Search Mailbox in the folder Freshman-TuitionIsssue.
This example searches all mailboxes of users in the Finance department for messages that contain the keywords insider, trading, or the phrase "stock buyback". The search results are copied to the Discovery Search Mailbox in the folder Finance-InsiderTrading.
This example runs an estimate-only search of all mailboxes in your organization that contain the words reorganization or layoffs. The output of this command is saved to a text file in the current directory.
Get-Mailbox -ResultSize unlimited | Search-Mailbox -SearchQuery 'reorganizaton OR layoffs' -EstimateResultOnly > Reorganization-EstimateOnly.txt
If you don’t redirect the results of an estimate-only search to a file, the results are displayed as output to the PowerShell command.
As previously mentioned, you can include an AQS query that searches the Sent property for a specific date range in the value of the SearchQuery parameter. The following example searches all mailboxes in your organization for messages that were sent between March 15, 2010 and April 15, 2010 and contains the phrase IRS audit in the subject field. The search results are copied to the Discovery Search Mailbox in the folder Allmailboxes-MarchApril.
The following table lists common message properties that you can include in the value for the SearchQuery parameter.
| Property | Example | Search results |
|---|---|---|
| Attachments | attachment:annualreport.ppt | Messages that have an attachment that is named annualreport.ppt. The use of attachment:annualreport or attachment:annual* returns the same results as using the full name of the attachment. |
| Cc | cc:"gurinder singh" cc:gurinders cc: gurinders@fineartschool.edu | Messages with Gurinder Singh in the Cc field |
| From | from:"Max Stevens" from:maxs from:maxs@contoso.com | Messages sent by Max Stevens |
| Sent | sent:10/19/2010 | Messages that were sent on October 19, 2010 |
| Sent | sent:1/1/2011..3/31/2011 | Messages that were sent between January 1, 2011 and March 31, 2011 |
| Sent | sent:>12/31/2008 | Messages that were sent after December 31, 2008 |
| Sent | sent:<07/01/2011 | Messages that were sent before July 1, 2011 |
| Subject | subject:"Quarterly Financials" | Messages that contain the exact phrase "Quarterly Financials" in the subject line |
| To | to:"Judy Lew" to:judyl to:judyl@contoso.com | Messages sent to Judy Lew |
