Search All Mailboxes with Windows PowerShell

 

Applies to: Office 365 for enterprises, Live@edu

Topic Last Modified: 2012-02-21

You can use Multi-Mailbox Search in the Exchange Control Panel to search up to 50 mailboxes. But if you’re searching more than 50 mailboxes, you have to use the Search-Mailbox cmdlet in Windows PowerShell. When you use this cmdlet, you can save the search results to the Discovery Search Mailbox.

For more information about searching mailboxes, see:

Contents

Before you begin

Parameters for the Search-Mailbox cmdlet

Search the mailboxes of lots of users

Run an estimate-only search

Search for message sent within a range of dates

E-mail message properties to search

Before you begin

To learn how to install and configure Windows PowerShell and connect to the service, see Use Windows PowerShell in Exchange Online.

Parameters for the Search-Mailbox cmdlet

The following table describes useful parameters that you can use with the Search-Mailbox cmdlet.

 

Parameter Required or optional Description

SearchQuery

Optional

This parameter specifies the keywords to search for or specifies a query formatted using Advanced Query Syntax (AQS). For more information, see:

Note   If you don’t include this parameter in the search command, all messages from the mailboxes you search will be included in the search results.

TargetMailbox

Required

This parameter specifies the discovery mailbox where search results are copied. The default discovery mailbox is named Discovery Search Mailbox.

TargetFolder

Required

This parameter specifies the name of a folder in which search results will be saved in the target mailbox. The folder is created in the target mailbox when you run the search.

LogLevel

Optional

This parameter specifies the logging level for the search. It can have one of the following values:

  • Suppress   No logs are kept.
  • Basic   Basic information about the search and who ran it is kept.
  • Full   In addition to the information kept by the Basic log level, the Full log level adds a complete list of search results in a CSV file attached to the basic log.

If you don’t include the LogLevel parameter, the basic information is kept.

EstimateResultOnly

Optional

This switch specifies that only an estimate of the total number and size of messages returned by the search will be provided. Messages aren't copied to the target mailbox. You can't use this switch with the TargetMailbox or TargetFolder parameters.

For more detailed information about all the parameters that you can use with the Search-Mailbox cmdlet, see Search-Mailbox.

Important   There are no parameters supported by the Search-Mailbox cmdlet that let you specify start or end dates to search for messages sent within a specific timeframe. However, you can still search for messages sent within a specific time frame by including an AQS query that searches the Sent property for a specific date range in the value of the SearchQuery parameter. For more information, see Search for message sent within range of dates.

Return to top

Search the mailboxes of lots of users

The following sections show examples of ways to use the Search-Mailbox cmdlet to search a large number of mailboxes.

Search all mailboxes in your organization

This example searches all mailboxes in your organization for messages that contain the words election, candidate, or vote. The search results are copied to the Discovery Search Mailbox in the folder AllMailboxes-Election.

Get-Mailbox -ResultSize unlimited | Search-Mailbox -SearchQuery 'election OR candidate OR vote' -TargetMailbox "Discovery Search Mailbox" -TargetFolder "AllMailboxes-Election" -LogLevel Full
Search the mailboxes of distribution group members

This example searches the mailboxes of all members in the Full Time Employees distribution group for messages that contain the term "employee handbook". The search results are copied to the Discovery Search Mailbox in the folder AllFTEMailboxes-HRPolicy.

Get-DistributionGroupMember "Full Time Employees" | Search-Mailbox -SearchQuery "employee handbook" -TargetMailbox "Discovery Search Mailbox" -TargetFolder " AllFTEMailboxes-HRPolicy" -LogLevel full
Search the mailboxes of dynamic distribution group members

This example searches the mailboxes of all members in the Freshman Class dynamic distribution group for messages that contain the term "tuition increase" in the Subject line. The search results are copied to the Discovery Search Mailbox in the folder Freshman-TuitionIsssue.

$DDG = Get-DynamicDistributionGroup "Freshman Class"
$mailboxes = Get-Recipient -RecipientPreviewFilter $DDG.RecipientFilter
$mailboxes | Search-Mailbox -SearchQuery 'Subject: "tuition increase"' -TargetMailbox "Discovery Search Mailbox" -TargetFolder "Freshman-TuitionIssue" -LogLevel full
Search mailboxes based on mailbox attributes

This example searches all mailboxes of users in the Finance department for messages that contain the keywords insider, trading, or the phrase "stock buyback". The search results are copied to the Discovery Search Mailbox in the folder Finance-InsiderTrading.

$mailboxes = Get-Recipient -ResultSize unlimited -Filter {Department -eq "Finance"}
$mailboxes | Search-Mailbox -SearchQuery 'inside OR trading OR "stock buyback"' -TargetMailbox "Discovery Search Mailbox" -TargetFolder "Finance-InsiderTrading" -LogLevel full

Return to top

Run an estimate-only search

This example runs an estimate-only search of all mailboxes in your organization that contain the words reorganization or layoffs. The output of this command is saved to a text file in the current directory.

Get-Mailbox -ResultSize unlimited | Search-Mailbox -SearchQuery 'reorganizaton OR layoffs' -EstimateResultOnly > Reorganization-EstimateOnly.txt

If you don’t redirect the results of an estimate-only search to a file, the results are displayed as output to the PowerShell command.

Search for messages sent within a range of dates

As previously mentioned, you can include an AQS query that searches the Sent property for a specific date range in the value of the SearchQuery parameter. The following example searches all mailboxes in your organization for messages that were sent between March 15, 2010 and April 15, 2010 and contains the phrase IRS audit in the subject field. The search results are copied to the Discovery Search Mailbox in the folder Allmailboxes-MarchApril.

Get-Mailbox -ResultSize unlimited | Search-Mailbox -SearchQuery '(sent:03/15/10..04/15/10) AND (subject:IRS audit)' -TargetMailbox "Discovery Search Mailbox" -TargetFolder " Allmailboxes-MarchApril" -LogLevel full

Return to top

E-mail message properties to search

The following table lists common message properties that you can include in the value for the SearchQuery parameter.

 

Property Example Search results

Attachments

attachment:annualreport.ppt

Messages that have an attachment that is named annualreport.ppt. The use of attachment:annualreport or attachment:annual* returns the same results as using the full name of the attachment.

Cc

cc:"gurinder singh"

cc:gurinders

cc: gurinders@fineartschool.edu

Messages with Gurinder Singh in the Cc field

From

from:"Max Stevens"

from:maxs

from:maxs@contoso.com

Messages sent by Max Stevens

Sent

sent:10/19/2010

Messages that were sent on October 19, 2010

Sent

sent:1/1/2011..3/31/2011

Messages that were sent between January 1, 2011 and March 31, 2011

Sent

sent:>12/31/2008

Messages that were sent after December 31, 2008

Sent

sent:<07/01/2011

Messages that were sent before July 1, 2011

Subject

subject:"Quarterly Financials"

Messages that contain the exact phrase "Quarterly Financials" in the subject line

To

to:"Judy Lew"

to:judyl

to:judyl@contoso.com

Messages sent to Judy Lew

Return to top

 
Related help topics
Loading...
No resources were found.