Exchange Server 2007 Cross Mailbox Search using Export-mailbox



Administrators have always needed a flexible way to search for content simultaneously across multiple mailboxes.  Here are a few scenarios requiring cross-mailbox search, and how the ‘export-mailbox’ command can be used to get the desired results.

Scenario 1: LEGAL DISCOVERY: The administrator needs a way to extract messages from multiple users’ mailboxes which contain certain keywords in the subject and/or body for Legal Discovery purposes. In this case, the content found does not need to be deleted, but only extracted to a single target mailbox.

Solution:  The administrator will need to use the Export-Mailbox task from the Exchange Management Shell with the –TargetFolder and –TargetMailbox parameters:


PS> get-mailbox –Database DB1 | Export-Mailbox –SubjectKeywords “Discovery Keywords” –TargetMailbox Administrator –TargetFolder ‘MyData’


This will search through all mailboxes on the Mailbox Database DB1 for messages containing the words “Discovery” and “Keywords” in the Subject field and copy these to a folder named MyData in the Administrator’s mailbox. A folder will be created for each user mailbox which had matching messages under the “MyData” folder, using the following naming convention: “Recovered Data – <MailboxAlias> – <Timestamp>”

Scenario 2: VIRUS THREAT RESPONSE: The administrator needs the ability to rapidly scan a large number of messages across multiple user mailboxes based on specific criteria to identify suspect messages that may be infected by a virus, and perform mass deletion of such email. In this case, the administrator is not required to keep copies of the deleted emails.

Solution: The administrator will need to use Export-Mailbox with the –TargetMailbox,-TargetFolder, and –DeleteContent parameters as follows


PS> get-mailbox | Export-Mailbox –ContentKeywords “Virus message” –TargetMailbox Administrator –TargetFolder ‘MyData’ –DeleteContent


This will search through all mailboxes in the organization for messages containing the words “Virus message” in the body and copy them to a folder named MyData in the Administrator’s mailbox, and delete the original message from the source mailboxes. The administrator can then delete all the messages under “My Data” to ensure that the suspect virus messages are eliminated. In order to delete the items, you will have to use the deletcontent parameter.

NOTE: To run the Export-Mailbox cmdlet on a computer that has the Mailbox server role installed, you must log on by using a domain account that has the permissions assigned to the Exchange Server Administrators group on the source server and the target server. The account must also be a member of the local Administrators group on that computer.  You cannot export data from a mailbox in one forest to a mailbox in a different forest. The source and target mailboxes must be in the same forest

For a complete listing of the search criteria that can be used as filters, and other options for the export-mailbox command, please type “Get-help Export-Mailbox” from the Exchange Management Shell. Alternatively, check the Exchange Server 2007 documentation online.

Kumar Cunchala


Comments (13)
  1. mike says:

    Another fantastic addition to Exchange2007 for administrators :-)

  2. nunoxf says:

    Hi,

    I just run the scenario 1 command in my test lab and realize that it created a folder for all mailboxes and not only for the ones that match the –SubjectKeywords string. Is there any way i don’t create empty folders ?

    Also i notice that it creates all folders from a user mailbox (Inbox, calendar, etc) even if there is only a message in the user’s Inbox folder.

    So, while this is a tremendous feature i loses it’s power when you search in hundreds of mailbox.

    Regards.

    PS. I’m still using Beta 2.

  3. kumar says:

    That is correct, the current implementation does

    – create one timestamped folder for each mailbox in the scope under the targetfolder

    – recreate the folder hierarchy for each mailbox under the timestamped folder for that mailbox

    regardless of whether there were matching messages found under that mailbox, or under that folder respectively.

    You do have the option of excluding certain folders from the result set using the "-ExcludeFolders" option, but this will also mean all messages in these folders will be excluded from your search scope itself (ie) even if there are messages containing the text you are looking for in the excluded folders, the search will not find them.

    Conversely, you also have the option of only including certain folders in your search scope, using the "-IncludeFolders" option. You can use this for large-volume searches if you are sure your target messages will be in one (or a small subset) of predefined folders. You will be out of luck however, if the messages have been moved to a customized folder name.

    I do see how it could be more efficient to just not create a folder in the result set if there are no matching messages in that folder, and to ignore mailboxes which did not contain any matching messages in the result set, and we will factor this into the suggested improvements to export-mailbox.

    For more information about export-mailbox and its options, please check out the following blog post:

    http://msexchangeteam.com/archive/2006/11/28/431669.aspx

  4. Ingram Leedy says:

    How about adding other properties, like searching To:, From:, Cc, fields? This is useful information when locating discovery information.

  5. kumar says:

    We will definitely consider adding these and additional properties as filter criteria for cross-mailbox search going forward.

  6. D.J. says:

    Is there any way to perform a similar search in Ex2003?

  7. Exchange says:

    D.J.

    the answer is unfortunately no, there is nothing native to Exchange 2003 that will let you do this kind of thing. Using Exmerge to explort across different mailboxes is the closest thing there.

  8. Robert says:

    I’ve tried this command and I’ve gotten two basic errors:  (Fortunately I’m using a test database

    1.  One error is that it copies everything over – not just the specified text – even though I specififed a very specific string to search for like -contentkeywords "zzz123456789".

    2. I get an error about moving the message – "MAPI or an unspecified service provider" ID no: 00000000-0000-000000000

    Are we sure this command is ready for prime time?

  9. Robert says:

    For my #1 error – when it faults – it seems like I get the entire mailbox into the target mailbox instead of just the filtered messages – ugh.

    For #2 – here’s the error message at the output:

    StatusCode                       : -1056749164

    StatusMessage                    : Error occurred in the step: Moving messages. Failed to copy messages to the destinat

                                      ion mailbox store with error:

                                      MAPI or an unspecified service provider.

                                      ID no: 00000000-0000-00000000

  10. Robert says:

    I have no clue why I can get this to work.  I’m the administrtor, single forest, one box – very simple exchange setup.   Seems like all the other posts regarding "export-mailbox" on the internet/blogs are basically copy and pastes from the Exchange 2007 help.  Has anyone actually used the commands on a real database? /sarcasm.

    Side note – Microsoft and Google’s search engines need to recognize queries such as "Export-Mailbox" as a single search term and stop "helping" me by taking out the dash and searching for "Export Mailbox".  Arg!

  11. Exchange says:

    Robert,

    Please open a case with Exchange Support on this, we ned to look into this a bit more and open a bug if needed. We do not know of this error as something that happens frequently but if we can reproduce it or see it reproduced, we can debug to see what is going on.

  12. Brown.Tim says:

    Anyone,

    Is there anywhere to seek and remove messages by the Message tracking ID?

Comments are closed.