Applies to: Exchange Server 2013
Topic Last Modified: 2012-10-12
After you create an In-Place eDiscovery search, you can modify it to change the search parameters. For example, you can change the mailboxes to be searched, date ranges, key words, logging options, or you can specify a different Discovery mailbox to store search results. Any changes you make to the search properties will be used when you restart the search.
For additional management tasks related to In-Place eDiscovery searches, see In-Place eDiscovery Procedures.
|If an In-Place eDiscovery search is running, you must stop it before modifying it. When you restart the search, the results from the last time the search was run are removed from the Discovery mailbox. However, the logs from previous searches are saved.|
What do you need to know before you begin?
- Estimated time to complete: 2-5 minutes.
- An In-Place eDiscovery search has been created and isn't
- You need to be assigned permissions before you can perform this
procedure or procedures. To see what permissions you need, see the
"In-Place eDiscovery" entry in the Messaging Policy and
Compliance Permissions topic.
- For information about keyboard shortcuts that may apply to the
procedures in this topic, see Keyboard Shortcuts in
the Exchange Admin Center.
What do you want to do?
Use the EAC to modify an In-Place eDiscovery search
- Navigate to Compliance management > In-place
eDiscovery & hold.
- In the list view, select the In-Place eDiscovery search you
want to modify, and then click Edit .
- In In-Place eDiscovery & Hold, you can modify the
- On Name page, modify the name for the search and the
- On the Mailboxes page, modify the mailboxes to search.
You can search across all mailboxes or select specific ones to
Important: You can’t use the Search all mailboxes option to place all mailboxes on Exchange 2013 Mailbox servers on hold. To create an In-Place Hold, you must select Specify mailboxes to search. For more details, see Create or Remove an In-Place Hold.
- On the Search query page, modify the following
- Include all user mailbox content Select
this option to place all content in the selected mailboxes on
- Filter based on criteria Select this
option to specify search criteria, including keywords, start and
end dates, sender and recipient addresses, and message types.
- Include all user mailbox content Select this option to place all content in the selected mailboxes on hold.
- On the In-Place Hold page, select the Place content
matching the search query in selected mailboxes on hold check
box, and then select one of the following options to place items on
- Hold indefinitely Select this option to
place the returned items on an indefinite hold. Items on hold will
be preserved until you remove the mailbox from the search or remove
- Specify number of days to hold items relative to their
received date Use this option to hold items for a specific
period. For example, you can use this option if your organization
requires that all messages be retained for at least seven years.
You can use a time-based In-Place Hold along with a
retention policy to make sure items are deleted in seven years.
Important: When placing mailboxes or items on In-Place Hold for legal purposes, it is generally recommended to hold items indefinitely and remove the hold when the case or investigation is completed.
- Hold indefinitely Select this option to place the returned items on an indefinite hold. Items on hold will be preserved until you remove the mailbox from the search or remove the search.
- On Name page, modify the name for the search and the optional description.
- Click Save.
Use the Shell to modify an In-Place eDiscovery search
This example modifies the In-Place eDiscovery search Search-Project Contoso to search mailboxes belonging to members of the DG-ProjectManagers distribution group.
Set-MailboxSearch -Identity "Search-Project Contoso" -SourceMailboxes "DG-ProjectManagers"
How do you know this worked?
To verify that you have successfully modified an In-Place eDiscovery search, do one of the following: