Previously I wrote an article on how to remove items larger than 25 MB from a mailbox or archive in preparation for a move to Office 365. However, one of the downsides was creating a report for the items that needed to be exported. Search-Mailbox was not capable of producing a report of how many items and what the total size of the items that needed to be removed. Solution? New-MailboxSearch.

With New-MailboxSearch I can create an estimate which will allow me to see the data. The only issue I found was that the syntax for the command was a bit of a pain to figure out. If you were to do an export using the Search-Mailbox command, the syntax would be as follows:

Get-Mailbox damian | Search-Mailbox -SearchQuery “Size:>5MB” -TargetMailbox damianscoles -TargetFolder Export -LogOnly -LogLevel Full

As you can see, for querying large items uses the syntax -SearchQuery “Size:>5MB”. This enables me to find items over 5 MB. the rest of the script will dump the items to the target mailbox listed in the one liner.

Now how do we do this with New-MailboxSearch

get-mailbox “Damian” | New-MailboxSearch -Name Damian -SearchQuery -estimateonly

For search criteria, if you check the HELP for the New-MailboxSearch command, you get this for -SearchQuery:
Search-Mailbox has this for the -searchquery switch:

If you notice that Search-Mailbox provides a link for the Keyboard Query Language (KQL) needed for queries. However, New-MailboxSearch uses the Advanced Query Syntax (AQS). However, the help for the command provides no clue as to what we can query for. After a bit of research I stumbled upon this very helpful link

If you review the list, size is still listed as something that can be queried. If you review this reference page for AQS, you will notice the syntax is something like this ‘size:> 50’. The 50 is the number of bytes in size a message is. If you are looking for items for Office 365 migrations, you should use the number ‘size:>26214400’. Here is a real world example of what I used to create my report:

Get-mailbox “Damian” | New-MailboxSearch -Name test -SearchQuery ‘size>26214400’ -estimateonly

After the command has been run, you need to initiate the search:

Get-MailboxSearch test |Start-MailboxSearch


To check the status of your test, run:

Get-MailboxSearch test |ft name,status,sourcemailboxes,PercentComplete,ResultNumberEstimate,ResultSizeEstimate -auto

Notice that you get a report of the Size of these items as an estimate.

Once you are done with the estimates, you can remove the search with:

Get-MailboxSearch test | Remove-MailboxSearch

And you will get prompted to make sure you want to remove the request:

There are many uses to this command and it certainly can come in handy for Office 365 moves.

Don’t forget you need Discovery Management rights in order to perform these commands. Otherwise the commands will fail.
AQS Help –


7 thoughts on “New-MailboxSearch

  1. Pingback: interesting things i have seen on the internet 30/12/2013 | 503 5.0.0 polite people say HELO
  2. Hello,
    I’m testing this in a Exchange 2010 “single server” environment (SP3). I try a command to find large items in one mailbox but none of your examples work:

    Search-Mailbox -id rsadmin -SearchQuery { Size:>100 } -EstimateResultOnly -Force
    A search keyword should not be preceeded with comparison modifiers eg. ”, ‘=’.

    Search-Mailbox -id rsadmin -SearchQuery { Size: } -EstimateResultOnly -Force
    The property keyword isn’t supported.

    Is there something wrong with my queries or do I need to do something to add “Size” as a keyword property ?

    Regards, @RikardStrand

    • Rikard,

      I had to re-write my reply because I was overthinking the issue.

      Your syntax is incorrect. You had ‘Search-Mailbox -id rsadmin -SearchQuery { Size:>100 } -EstimateResultOnly -Force’. It should be

      new-mailboxsearch -id rsadmin -SearchQuery ‘size>838860800 ′ -EstimateResultOnly -Force


      Search-Mailbox -identity rsadmin -SearchQuery “Size:>100MB” -TargetMailbox -TargetFolder Export -LogOnly -LogLevel Full

      Using Search-Mailbox command you need different syntax because it is using a different Query Language.

      * 2010 – The SearchQuery parameter specifies a search string or a query formatted using Advanced Query Syntax (AQS).
      * 2013 – The SearchQuery parameter specifies a search string or a query formatted using Keyword Query Language (KQL).

  3. Hello,

    Thanks for your quick reply, however I do not get any of these commands to work on a Exchange 2010 Environment. Seems like it Works from a Exchange 2013 environment.

    I will try to find some other solutions (EWS) to my problems.

    KUDOS for taking time and helping me. 🙂

  4. Thanks, this is a great article. I’ve been scratching my head trying to figure out why seemingly identical searches give different results depending on whether done with Search-Mailbox or New-MailboxSearch.
    For example:
    Search-mailbox -searchquery “Received:5/1/2017..5/31/2017 AND” -estimateresultonly
    New-mailboxsearch -sourcemailbox -recipients -startdate 5/1/2017 -enddate 5/31/2017 -estimateresultonly

    Both searches use the same criteria, but always return different results. On the other hand, the same search for sent items (change ‘To:’ to ‘From:’, and ‘-recipients’ to ‘-sender’) does return the same result.

  5. I was so hoping to find out if KQL has any means of doing exact subject searches. Nobody seems to want to say its not supported. If that the case, MS should document it. I have swept up more unwanted emails foolishly thinking subject:’bank statement” (or many other forms of this) would only get me subjects with that exact phase. Instead I get every email with bank and statement. This make the subject aspect of the search function crippled bordering on useless. And god forbid I could search on message trace or message trace id.
    Use search-mailbox and its clumsy KQL at your own ruisk; that is lots of testing on important data. I think you will be surprised at the multitude short comings at what could have been a promising command.

    Back to the drawing board

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s