none
Search-Mailbox - SearchQuery options

    Question

  • Where can I find the list of commands that I can use within the -SearchQuery command of the Exchange 2010 SP1 cmdlet Search-Mailbox
    Thursday, October 28, 2010 7:10 PM

Answers

All replies

  • Thursday, October 28, 2010 7:14 PM
  • Here is the list of Advanced Query Syntax (AQS) keywords you can use:

    http://technet.microsoft.com/en-us/library/bb232132.aspx#AQS


    Mike Pfeiffer | blog: mikepfeiffer.net | twitter: @mike_pfeiffer
    Thursday, October 28, 2010 8:31 PM
  • get-mailbox -OrganizationalUnit "Cheese.dom/SpecialAccess/Awsome/Users" | Search-Mailbox -SearchQuery subject:'Party in the Office',from:'Bob@Cheese.dom' -DeleteContent

    Exchange 2010 SP2 This worked no errors:
    Use any identifer to get the mailbox group you want: Get-Mailbox -resultsize unlimited or -idenity or whatever..,
    get-mailbox -OrganizationalUnit "Cheese.dom/SpecialAccess/Awsome/Users" | Search-Mailbox -SearchQuery subject:'Party in the Office',from:'Bob@Cheese.dom' -DeleteContent
    Good luck

    Exchange Search keywords

    Property

    Example

    Search results

    Attachments

    attachment:’annualreport.pptx’

    Messages that have an attachment named annualreport.pptx. The use of attachment:annualreport or attachment:annual* returns the same results as using the full name of the attachment.

    Cc

    cc:’paulshen’

    cc:’pauls’

    cc:’pauls@contoso.com’

    Messages with Paul Shen in the Cc field.

    From

    from:’bharatsuneja’

    from:’bsuneja’

    from:’bsuneja@contoso.com’

    Messages sent by Bharat Suneja.

    Keywords in retention policy

    retentionpolicy:’business critical’

    Messages that have the Business Critical retention tag applied.

    Date when messages expire according to policy

    expires:’4/1/2010’

    Messages that expire on April 1, 2010.

    Sent

    sent:yesterday

    All messages sent yesterday.

    Subject

    Subject:’patent filing’

    All messages where the phrase “patent filing” appears in the Subject field.

    To

    to:’benSmith’

    to:’bsmith’

    to:’besmith@contoso.com’

    Messages that have Ben Smith in the To field.

    • Proposed as answer by Magus_Wade Friday, August 03, 2012 2:01 PM
    Friday, August 03, 2012 1:57 PM
  • How do you include a subject that has "Re:" in it.  I keep trying things but it won't work due to the ":".  I tried for example:

    'Subject:"Re`:` Subject Title"' but that doesn't work.  Have also tried 'Subject:"Re: Subject Title"' and that also does not work.  If I search for just "Subject Title" it will include messages with Re: in the title but seems like there should be a way to narrow it down.  Too bad we can search on ESMTP ID or something more unique.

    Saturday, August 11, 2012 2:00 AM
  • Place the subject in double quotes instead of the single quote, if you only on the "Re:" subjects.  If you want all the subjests realted then using the single quote will get the Re:.

    Example:get-mailbox -OrganizationalUnit "Cheese.dom/SpecialAccess/Awsome/Users" | Search-Mailbox -SearchQuery subject:'Party in the Office',from:'Bob@Cheese.dom' -DeleteContent

    The above will delete any subject that contains 'Party in the Office', from Bob.
    So Re:Party in the Office would be deleted.

    get-mailbox -OrganizationalUnit "Cheese.dom/SpecialAccess/Awsome/Users" | Search-Mailbox -SearchQuery subject:"Party in the Office",from:'Bob@Cheese.dom' -DeleteContent

    Using the double quote will result in only "Party in the Office" from Bob to be deleted.

    Hope that helps.

    Monday, December 03, 2012 11:58 AM
  • How do you specify just the emails in the Inbox folder and not any of the subfolders underneath the Inbox?  I tried the syntax below but it returned a "The property keyword isn't supported."  The date part works fine as it deletes the emails older than 90 days.  But it deletes emails in subfolders too.

    $Today = (Get-Date).adddays(-90)
    Search-Mailbox -Identity 'crmemail' -TargetMailbox 'zztestdb02' -targetfolder 'deletedinboxcrmemails' -SearchQuery "Received:< $($Today) and foldername:inbox" -loglevel full -DeleteContent

    Wednesday, December 05, 2012 5:37 PM