New-MailboxSearch

Previously I wrote an article on how to remove items larger than 25 MB from a mailbox or archive in preparation for a move to Office 365. However, one of the downsides was creating a report for the items that needed to be exported. Search-Mailbox was not capable of producing a report of how many items and what the total size of the items that needed to be removed. Solution? New-MailboxSearch.

With New-MailboxSearch I can create an estimate which will allow me to see the data. The only issue I found was that the syntax for the command was a bit of a pain to figure out. If you were to do an export using the Search-Mailbox command, the syntax would be as follows:

Get-Mailbox damian | Search-Mailbox -SearchQuery “Size:>5MB” -TargetMailbox damianscoles -TargetFolder Export -LogOnly -LogLevel Full

As you can see, for querying large items uses the syntax -SearchQuery “Size:>5MB”. This enables me to find items over 5 MB. the rest of the script will dump the items to the target mailbox listed in the one liner.

Now how do we do this with New-MailboxSearch

get-mailbox “Damian” | New-MailboxSearch -Name Damian -SearchQuery -estimateonly

For search criteria, if you check the HELP for the New-MailboxSearch command, you get this for -SearchQuery:
SearchQuery
Search-Mailbox has this for the -searchquery switch:

SearchQuery02
If you notice that Search-Mailbox provides a link for the Keyboard Query Language (KQL) needed for queries. However, New-MailboxSearch uses the Advanced Query Syntax (AQS). However, the help for the command provides no clue as to what we can query for. After a bit of research I stumbled upon this very helpful link http://msdn.microsoft.com/en-us/library/aa965711%28v=vs.85%29.aspx

If you review the list, size is still listed as something that can be queried. If you review this reference page for AQS, you will notice the syntax is something like this ‘size:> 50’. The 50 is the number of bytes in size a message is. If you are looking for items for Office 365 migrations, you should use the number ‘size:>26214400’. Here is a real world example of what I used to create my report:

Get-mailbox “Damian” | New-MailboxSearch -Name test -SearchQuery ‘size>26214400’ -estimateonly

StartSearch2
After the command has been run, you need to initiate the search:

Get-MailboxSearch test |Start-MailboxSearch

StartSearch3

To check the status of your test, run:

Get-MailboxSearch test |ft name,status,sourcemailboxes,PercentComplete,ResultNumberEstimate,ResultSizeEstimate -auto

StartSearch
Notice that you get a report of the Size of these items as an estimate.

Once you are done with the estimates, you can remove the search with:

Get-MailboxSearch test | Remove-MailboxSearch

And you will get prompted to make sure you want to remove the request:

New-MailboxSearch04
There are many uses to this command and it certainly can come in handy for Office 365 moves.

Notes
Don’t forget you need Discovery Management rights in order to perform these commands. Otherwise the commands will fail.
AQS Help – http://msdn.microsoft.com/en-us/library/aa965711%28v=vs.85%29.aspx

Advertisements

4 thoughts on “New-MailboxSearch

  1. Pingback: interesting things i have seen on the internet 30/12/2013 | 503 5.0.0 polite people say HELO
  2. Hello,
    I’m testing this in a Exchange 2010 “single server” environment (SP3). I try a command to find large items in one mailbox but none of your examples work:

    Search-Mailbox -id rsadmin -SearchQuery { Size:>100 } -EstimateResultOnly -Force
    A search keyword should not be preceeded with comparison modifiers eg. ”, ‘=’.

    Search-Mailbox -id rsadmin -SearchQuery { Size: } -EstimateResultOnly -Force
    The property keyword isn’t supported.

    Is there something wrong with my queries or do I need to do something to add “Size” as a keyword property ?

    Regards, @RikardStrand

    • Rikard,

      I had to re-write my reply because I was overthinking the issue.

      Your syntax is incorrect. You had ‘Search-Mailbox -id rsadmin -SearchQuery { Size:>100 } -EstimateResultOnly -Force’. It should be

      new-mailboxsearch -id rsadmin -SearchQuery ‘size>838860800 ′ -EstimateResultOnly -Force

      or

      Search-Mailbox -identity rsadmin -SearchQuery “Size:>100MB” -TargetMailbox -TargetFolder Export -LogOnly -LogLevel Full

      Using Search-Mailbox command you need different syntax because it is using a different Query Language.

      * 2010 – The SearchQuery parameter specifies a search string or a query formatted using Advanced Query Syntax (AQS).
      * 2013 – The SearchQuery parameter specifies a search string or a query formatted using Keyword Query Language (KQL).

  3. Hello,

    Thanks for your quick reply, however I do not get any of these commands to work on a Exchange 2010 Environment. Seems like it Works from a Exchange 2013 environment.

    I will try to find some other solutions (EWS) to my problems.

    KUDOS for taking time and helping me. 🙂

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s