Applies to: Exchange Server 2013

Topic Last Modified: 2013-01-17

Use the New-MailboxSearch cmdlet to create a mailbox search and either get an estimate of search results, place search results on In-Place Hold or copy them to a Discovery mailbox. You can also place all contents in a mailbox on hold by not specifying a search query, which accomplishes similar results as litigation hold in Microsoft Exchange Server 2010.

Caution:
Mailbox searches are performed across all mailboxes on Microsoft Exchange Server 2013 servers in an Exchange organization, unless the search is constrained to fewer mailboxes by using the SourceMailboxes parameter.
Important:
When you create a mailbox search using this cmdlet on an Exchange 2013 server, mailboxes on previous versions of Exchange aren't searched. You must search mailboxes on Exchange Server 2010 by running the command on an Exchange 2010 server.

For more information, see In-Place eDiscovery and In-Place Hold.

For information about the parameter sets in the Syntax section below, see Syntax.

Syntax

New-MailboxSearch -Name <String> [-Confirm [<SwitchParameter>]] [-Description <String>] [-DomainController <Fqdn>] [-EndDate <ExDateTime>] [-EstimateOnly <SwitchParameter>] [-ExcludeDuplicateMessages <$true | $false>] [-Force <SwitchParameter>] [-IncludeKeywordStatistics <SwitchParameter>] [-IncludeUnsearchableItems <SwitchParameter>] [-InPlaceHoldEnabled <$true | $false>] [-InPlaceHoldIdentity <String>] [-ItemHoldPeriod <Unlimited>] [-Language <CultureInfo>] [-LogLevel <Suppress | Basic | Full>] [-MessageTypes <KindKeyword[]>] [-Recipients <String[]>] [-SearchQuery <String>] [-Senders <String[]>] [-SourceMailboxes <RecipientIdParameter[]>] [-StartDate <ExDateTime>] [-StatusMailRecipients <RecipientIdParameter[]>] [-TargetMailbox <MailboxIdParameter>] [-WhatIf [<SwitchParameter>]]

Examples

EXAMPLE 1

This example creates the mailbox search Legal-ProjectX. The search uses several parameters to restrict the query:

  • SourceMailboxes   This parameter restricts the search to members of the DG-Marketing and DG-Executives distribution groups.

  • Recipients   This parameter specifies that the search includes all mail sent to the domain contoso.com.

  • SearchQuery   This parameter specifies an AQS query for messages with either the words project or report and for messages with attachments.

  • StartDate and EndDate   These parameters specify the start date of January 1, 2011, and end date of December 31, 2011, for the search.

  • TargetMailbox   This parameter specifies that search results should be copied to the discovery mailbox LegalDiscovery.

  • StatusMailRecipeints   This parameter specifies that the distribution group DG-DiscoveryTeam is to receive a notification when the search is complete.

Copy Code 
New-MailboxSearch -Name "Legal-ProjectX" -SourceMailboxes DG-Marketing,DG-Executives -TargetMailbox LegalDiscovery@contoso.com -StartDate "01/01/2011" -EndDate "12/31/2011" -Recipients "*@contoso.com" -SearchQuery "project report hasattachments:true" -StatusMailRecipients "DG-DiscoveryTeam"

EXAMPLE 2

This example creates an In-Place Hold Hold-ProjectX and places all members of the distribution group DG-Finance on hold. Because the search doesn't specify the SearchQuery and ItemHoldPeriod parameters, all messages in mailboxes returned are placed on indefinite In-Place Hold.

Copy Code 
New-MailboxSearch -Name "Hold-ProjectX" -SourceMailboxes DG-Finance -InPlaceHoldEnabled $true

EXAMPLE 3

This example creates an In-Place Hold Hold-tailspintoys and places all members of the distribution group DG-Research on hold. Because the search specifies the SearchQuery parameter, only messages that match the search query are placed on indefinite In-Place Hold.

Copy Code 
New-MailboxSearch -Name "Hold-tailspintoys" -SourceMailboxes DG-Research -SearchQuery "'Patent' AND 'Project tailspintoys'" -InPlaceHoldEnabled $true

Detailed Description

The New-MailboxSearch cmdlet creates an In-Place eDiscovery search or an In-Place Hold. Unless specified, mailboxes on all Exchange 2013 servers in an organization are searched. You can stop, start, modify, or remove the search.

You need to be assigned permissions before you can run this cmdlet. Although all parameters for this cmdlet are listed in this topic, you may not have access to some parameters if they're not included in the permissions assigned to you. To see what permissions you need, see the "In-Place eDiscovery" and "In-Place Hold" entries in the Messaging Policy and Compliance Permissions topic.

Parameters

Parameter Required Type Description

Name

Required

System.String

The Name parameter specifies a friendly name for the search. Search results are copied to a folder in the mailbox specified by the TargetMailbox parameter. The folder name is the same as the search name.

Confirm

Optional

System.Management.Automation.SwitchParameter

The Confirm switch causes the command to pause processing and requires you to acknowledge what the command will do before processing continues. You don't have to specify a value with the Confirm switch.

Description

Optional

System.String

The Description parameter specifies a description for the search. The description isn't displayed to users.

DomainController

Optional

Microsoft.Exchange.Data.Fqdn

The DomainController parameter specifies the fully qualified domain name (FQDN) of the domain controller that writes this configuration change to Active Directory.

EndDate

Optional

Microsoft.Exchange.ExchangeSystem.ExDateTime

The EndDate parameter specifies an end date and time for the search. Messages dated on or before the end date will be searched. The default time is the current time. When you enter a specific date, use the short date format defined in the Regional Options settings configured on the local computer. For example, if your computer is configured to use the short date format mm/dd/yyyy, enter 03/01/2012 to specify March 1, 2012. You can enter the date only, for example, 10/05/2011. Or you can enter the date and time of day. If you enter a time of day and date, you must enclose the argument in quotation marks ("), for example, "10/05/2011 5:00:00 PM".

EstimateOnly

Optional

System.Management.Automation.SwitchParameter

The EstimateOnly switch specifies that only an estimate of the number of items that will be returned is provided. If not specified, messages are copied to the target mailbox.

ExcludeDuplicateMessages

Optional

System.Boolean

The ExcludeDuplicateMessages parameter eliminates duplication of messages in search results. Set the parameter to $true to copy a single instance of a message if the same message exists in multiple folders or mailboxes.

Force

Optional

System.Management.Automation.SwitchParameter

The Force parameter creates the search, overwriting any existing searches with the same name.

IncludeKeywordStatistics

Optional

System.Management.Automation.SwitchParameter

The IncludeKeywordStatistics switch returns keyword statistics (number of instances for each keyword) in search results.

IncludeUnsearchableItems

Optional

System.Management.Automation.SwitchParameter

The IncludeUnsearchableItems switch specifies whether items that couldn't be indexed by Exchange Search should be included in the search results. The IncludeUnsearchableItems parameter doesn't require a value.

Important:
In Exchange 2013, specifying this switch doesn't result in unsearchable items being placed on hold. To place unsearchable items on hold, create a search without specifying search parameters, which accomplishes the same results as litigation hold in Exchange 2010.

InPlaceHoldEnabled

Optional

System.Boolean

The InPlaceHoldEnabled parameter specifies whether an In-Place Hold has been placed on items matching the search query. Set the parameter to $true to enable In-Place Hold. If the ItemHoldPeriod parameter isn't specified, items are held until the hold is removed by deleting the search or removing a mailbox from the search. You can add or remove mailboxes from a mailbox search by modifying the SourceMailboxes parameter. If you don't specify a search query, all items in the specified mailboxes are placed on hold.

InPlaceHoldIdentity

Optional

System.String

This parameter is reserved for internal Microsoft use.

ItemHoldPeriod

Optional

Microsoft.Exchange.Data.Unlimited

The ItemHoldPeriod parameter specifies the number of days for which to hold mailbox items matching the search query. The duration is calculated from the time the item is received or created in the mailbox.

Language

Optional

System.Globalization.CultureInfo

The Language parameter specifies a locale for the search.

LogLevel

Optional

Microsoft.Exchange.Data.Storage.Infoworker.MailboxSearch.LoggingLevel

The LogLevel parameter specifies the logging level for the search. It can have one of the following values:

  • Suppress   No logs are kept.

  • Basic   Basic information about the query and who ran it is kept.

  • Full   In addition to the information kept by the Basic log level, the Full log level adds a complete list of search results.

MessageTypes

Optional

Microsoft.Exchange.Data.Search.AqsParser.KindKeyword[]

The MessageTypes parameter specifies the message types to include in the search. Valid values can be one or more of the following:

  • Email

  • Meetings

  • Tasks

  • Notes

  • Docs

  • Journals

  • Contacts

  • IM

If not specified, all message types are included.

Recipients

Optional

System.String[]

The Recipients parameter specifies one or more recipients. Messages that have the recipients in the To, Cc, and Bcc fields are returned.

SearchQuery

Optional

System.String

The SearchQuery parameter specifies a search string or a query formatted using Advance Query Syntax (AQS).

If this parameter is empty, all messages from all mailboxes specified in the SourceMailboxes parameter are returned.

Senders

Optional

System.String[]

The Senders parameter specifies the SMTP address of one or more senders.

SourceMailboxes

Optional

Microsoft.Exchange.Configuration.Tasks.RecipientIdParameter[]

The SourceMailboxes parameter specifies the identity of one or more mailboxes to be searched.

Note:
If not specified, all mailboxes in the Exchange 2013 organization are searched. To enable In-Place Hold, you must specify the SourceMailboxes parameter.

StartDate

Optional

Microsoft.Exchange.ExchangeSystem.ExDateTime

The StartDate parameter specifies a start date and time for the search.

For valid date and time formatting options, refer to the description of the EndDate parameter.

StatusMailRecipients

Optional

Microsoft.Exchange.Configuration.Tasks.RecipientIdParameter[]

The StatusMailRecipients parameter specifies one or more recipients to receive a status email message upon completion of the search.

TargetMailbox

Optional

Microsoft.Exchange.Configuration.Tasks.MailboxIdParameter

The TargetMailbox parameter specifies the identity of the destination mailbox where search results are copied. You can use the following values:

  • Alias

  • Display name

  • Domain\Account

  • SMTP address

  • Distinguished name (DN)

  • Object GUID

  • User principal name (UPN)

  • LegacyExchangeDN

WhatIf

Optional

System.Management.Automation.SwitchParameter

The WhatIf switch instructs the command to simulate the actions that it would take on the object. By using the WhatIf switch, you can view what changes would occur without having to apply any of those changes. You don't have to specify a value with the WhatIf switch.

Input Types

To see the input types that this cmdlet accepts, see Cmdlet Input and Output Types. If the Input Type field for a cmdlet is blank, the cmdlet doesn’t accept input data.

Return Types

To see the return types, which are also known as output types, that this cmdlet accepts, see Cmdlet Input and Output Types. If the Output Type field is blank, the cmdlet doesn’t return data.