Exchange 2010 Discovery: Modify the maximum number of mailboxes searched at a time

In Exchange 2010, you can use Multi-Mailbox Search to search mailboxes for e-Discovery or similar purposes. To preserve data in user mailboxes and protect its integrity, you can place a mailbox on Litigation Hold (also known as legal hold). This prevents mailbox items from being purged from the Store, without impacting user workflow. Additionally, when a mailbox is on litigation hold, a process known as copy-on-write (yes, COW) preserves a copy of the original item when a modification is made to certain item properties.

Note, COW also kicks in for a mailbox when you enable Single Item Recovery – check out RS4’s (also known as Ross Smith IV) post Single Item Recovery in Exchange Server 2010 and Understanding Recoverable Items in Exchange 2010 documentation for details.

When creating or modifying a discovery search using the ECP, a discovery manager can specify the mailboxes to search or select the Search all mailboxes option. If you select the latter, all Exchange 2010 mailboxes in the organization are searched. If you’re using the New-MailboxSearch cmdlet to create a discovery search and don’t specify the SourceMailboxes parameter, all Exchange 2010 mailboxes are searched by default.

Screenshot: Exchange 2010 Discovery - Search all mailboxes
Figure 1: In Exchange 2010, you can use Multi-Mailbox Search to search all mailboxes in your organization

This works if you have less than 25,000 mailboxes in your organization, but exceed that number and you’ll see the following error message:

The search exceeded the maximum number of mailboxes that can be searched at a time. Please try searching less than 25,000 mailboxes.

In on-premises Exchange 2010 deployments, the maximum number of mailboxes you can search at a time is capped at 25,000. In Understanding Multi-Mailbox Search, we state:

To perform a mailbox search for more than 25,000 mailboxes, you can split the search into multiple searches, for example by searching mailboxes in a distribution group, including dynamic distribution groups.

Feedback from most customers indicates that the majority of discovery searches do not exceed 20 mailboxes, although there have been some questions on whether this limit can be raised (or lowered).

In Exchange 2010 SP1, you can modify the default by creating the following registry entry on all Exchange 2010 Mailbox servers in your organization:

  • Path: HKLM\SOFTWARE\Microsoft\ExchangeServer\v14\Discovery
  • Name: MaxNumberOfMailboxes
  • Type: DWORD
  • Value: Maximum number of mailboxes to search in a single discovery search.

The requisite PowerShell one-liner: You can use the Registry Editor to create the Discovery registry key and the MaxNumberOfMailboxes value, but if you need to do this on more than 2-3 servers, automating it would be a good idea. Here’s a PowerShell one-liner to accomplish this – this one will set it to 300 mailboxes. (As usual, make sure you test all scripts/commands/code downloaded from the web in a test environment!)

$path=”HKLM:\Software\Microsoft\ExchangeServer\v14\Discovery”; If (Test-Path $path){“exists”} Else {“$path does not exist”; md $path}; new-itemproperty $path -Name “MaxNumberOfMailboxes” -PropertyType “DWord” -Value 300

Yes, you can. But should you?

Although it’s possible to raise the maximum number of mailboxes searched to a much higher number, for example – 100,000 mailboxes, or even a million mailboxes, keep in mind that each mailbox searched adds some memory overhead on the Mailbox server where the discovery mailbox (aka the target mailbox – this is the discovery mailbox you selected to have search results copied to) is located.

An additional consideration may be the size of your search results and how large you want the discovery mailbox to grow. Depending on what you’re searching for, a discovery search of 100,000 mailboxes may result in a large number of messages in your search results. In Exchange 2010 SP1, we added deduplication of discovery search results, so only one instance of a message is copied if multiple copies are found in the same mailbox or across multiple mailboxes, which can reduce the result size quite a bit. Nevertheless, consider the size of the discovery mailbox, which is controlled by mailbox quotas.

Finally, network bandwidth may be an additional consideration in larger deployments. Do you want to search mailboxes across slower WAN links and copy all data to a single discovery mailbox in one location? A better alternative may be to divide the task and perform a few searches with smaller number of users restricted by location, department or other factors. As stated earlier in this post, you can specify a distribution group or dynamic distribution group to search mailboxes of its members.

If there are other factors you would consider in your environment when deciding to perform a discovery search, we’d love to hear from you! You can share them in the comments section or send us feedback using the contact form.

Bharat Suneja

Comments (11)
  1. Tim Huang says:

    Excellent post guys!

  2. Mohit says:

    Thank you so much for posting this Bharat – we've been looking for this!!

  3. Looks good. Keep improve Exchange!

  4. exchangeuser says:

    Great Article! thanks

    Lately we have seen huge growth of the discovery mailbox even we haven't perform any searches? What can be the cause..any ideas? And what happens if it reaches its max limit?

  5. Bharat Suneja [MSFT] says:

    @exchangeuser: Discovery uses two types of mailboxes – 1) discovery mailboxes to store search results (setup creates one discovery search mailbox, you can create additional discovery mailboxes) and 2) a system/arbitration mailbox to store search metadata, which you shouldn't need to touch. See Understanding Multi-Mailbox Search for details.

    Are you referring to the default discovery search mailbox? Discovery mailboxes should not grow if you're not performing any searches.

  6. exchangeuser says:

    Thanks Bharat for getting back. Yes i was talking about the default discovery search mailbox. however today i checked the size..see below

    [PS] C:Windowssystem32>Get-MailboxStatistics "SystemMailbox{e0dc1c29-89c3-4034-b678-e6c29d823ed9}" |fl *total*

    TotalDeletedItemSize : 985.4 MB (1,033,240,614 bytes)

    TotalItemSize        : 146.2 KB (149,665 bytes)

  7. exchangesuser says:

    its a system/arbitration mailbox

  8. Jordan Mejia says:

    @ Bharat, Suneja[MSFT]

    I have tried everything you've said in this article to implement the GAL photos in exchange 2010, and for some reason only 1 person is actually able to see the test pictures i have done. What could be the cause to this?

  9. Bharat Suneja [MSFT] says:

    @Jordan Mejia: Wrong post! :)

    First thing I'd look for is what's different between the user who can see the thumbnails in Outlook and others who can't. Are they in online mode? Any Active Directory replication issues? Was the schema change made (if they're in different domains)?

    Please post in Exchange forums for follow-up – comments on the GAL Photos posts are closed.

  10. says:

    @Bharat Suneja

    Sry to post on the wrong blog again but for some reason i am unable to post on the GAL Photos blog? i have one simple question. How can i import pictures in bulk? I've read what it has to say about the Get-DistributionGroupMember and Get-Mailbox cmdlets on the microsoft Technet site and don't think i understand them quite properly.

  11. Bharat Suneja [MSFT] says:

    @ FlipLeprechaun: As responded earlier, post comments close in 90 days, which is why you are no longer able to comment on that post. To import profile pics in bulk, you'd have to have the profile pic file names map to a unique user attribute – for example, username or alias, and then use Get-Mailbox to lookup the user and pipe to Import-RecipientDataProperty to import the photo.

    The details would be ideal for an article or blog post if one doesn't already exist.

Comments are closed.