none
compliance search RRS feed

  • Question

  • Hi All

    How do i run the below syntax using compliance search

    Search-Mailbox -Identity myuser@contoso.com -SearchQuery 'Subject:"Re: TEST: This isn't the correct mail ... for xyx or abc" AND From:John@abc.com AND Received:"06/15/2020 00:00..06/25/2020 23:59"' -TargetMailbox "admin@contoso.com" -TargetFolder "search" -LogOnly -LogLevel Full
    Sunday, June 28, 2020 6:30 PM

All replies

  • Hi,

    You can do the search in following way. Note that On July 1, 2020, the Search-Mailbox cmdlet is being retired and Microsoft Support will no longer provide assistance

    1. Connect Exchange Online - Connect ExchangeOnline
    2. Run the following cmdlets
    New-RoleGroup "Mailbox Import-Export Management" -Roles "Mailbox Import Export"
    Add-RoleGroupMember "Mailbox Import-Export Management" -Member "youremail"
    3. Close and re-connect Exchange Online
    4. Run search command in similar format as below:
    Search-Mailbox -Identity manutest@exchangeonline.in -SearchQuery 'Subject:"testsearch" AND From:manu@exchangeonline.in AND Received:"06/28/2020 00:00..06/28/2020 23:59"' -TargetMailbox "manu@exchangeonline.in" -TargetFolder "search" -LogOnly -LogLevel Full

    Regards From: Exchange Online | World of Cloud Computing


    Sunday, June 28, 2020 7:59 PM
  • Hi ItsMe-Roger,

    In compliance search, there doesn't exist "TargetFolder".

    What do you mean about the compliance search, the Content search in Office 365 admin center or in-place eDiscovery & hold in Exchange online admin center(it will be retired)?

    If you doesn't familiar with compliance search command, you could create it from Content search directly.

    If you want to know how to create from PowerShell, you could use command below to check the filter(You need to use PowerShell connect to "Office 365 Security & Compliance Center"):

    Get-ComplianceSearch -Identity SearchName| fl ContentMatchQuery

    Regards,

    Kyle Xu


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Monday, June 29, 2020 6:36 AM
    Moderator
  • 1. As search mailbox syntax is going to depreciate, can we use content search from powershell rather than gui

    2. for example i want to search by message subject TEST, content search brings replied emails, forwarded emails by test not by exact subject TEST  how can i just get by subject TEST

    Monday, June 29, 2020 2:30 PM
  • 1. As search mailbox syntax is going to depreciate, can we use content search from powershell rather than gui

    2. for example i want to search by message subject TEST, content search brings replied emails, forwarded emails by test not by exact subject TEST  how can i just get by subject TEST

    1. Since you unfamiliar with how to use it in PowerShell directly. So, I would suggest you try to create in GUI, then check from PowerShell. In this way, you will could know and study how to use it in PowerShell.

    If you want to learn how to use it from PowerShell directly, this article will be useful to you:

    2. It search emails by "contain" rather than "equal".

    Regards, 

    Kyle Xu


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Thursday, July 2, 2020 7:46 AM
    Moderator
  • Hi ItsMe-Roger,

    I am writing here to confirm with you how thing going now?

    If the above suggestion helps, please be free to mark it as an answer for helping more people.

    Regards,

    Kyle Xu


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Monday, July 6, 2020 8:54 AM
    Moderator
  • i have used the below

    Subject/Title: test
    Sender: Equals any of

    i am getting the below output, i only want to get the emails with subject test not any replied emails or forwarded emails


    • Edited by ItsMe-Roger Monday, July 13, 2020 10:33 AM d
    Monday, July 13, 2020 10:33 AM