Exchange – Search For Keyword

Search-Mailbox -Identity “Joe Healy” -SearchQuery “Subject:Project Hamilton” -TargetMailbox “My Mailbox” -TargetFolder “JoeHealy-ProjectHamilton” -LogLevel Full

This example searches all mailboxes in your organization for messages that contain the words “election”, “candidate”, or “vote”. The search results are copied to the “My Mailbox”:

Get-Mailbox | Search-Mailbox -SearchQuery ‘election OR candidate OR vote’ -TargetMailbox “My Mailbox” -TargetFolder “AllMailboxes-Election” -LogLevel Full

Search for mails sent to Sarah between 22 March – 1st of April :

Search-Mailbox -identity journal.mailbox -SearchQuery ‘received:22/3/2013 .. 1/4/2013 and To: Sarah Jones’  -TargetMailbox “My Mailbox” -TargetFolder “My_Search” -LogLevel Full

SearchQuery “Subject:’Payment repor*’ or attachment:’whatever.zip'”

Property Description Values Example syntax
All This property returns all messages that have a particular string in any of the indexed properties. For example, use this property if you want to export all messages that have “Ayla” as the recipient, the sender, or have the name mentioned in the message body. StringWildcard
Copy Code
-ContentFilter {All -like "*Ayla*"}
Attachment This property returns messages that have the specified string in the content of an attachment or in the attachment’s file name. StringWildcard
Copy Code
-ContentFilter {Attachment -like "*.jpg"}
BCC This property returns sent messages that have the specified recipient in the Bcc field. Display nameAlias

SMTP address

LegacyDN

Wildcard

Copy Code
-ContentFilter {(BCC -eq 'ayla@contoso.com') -or (BCC -eq 'tony@contoso.com')}
Body This property returns messages that have the specified string within the message body. StringWildcard
Copy Code
-ContentFilter {Body -like "*prospectus*"}
Category This property returns messages that have a matching category. Categories are set by users or Inbox rules. StringWildcard
Copy Code
-ContentFilter {Category -like "*Blue*"}
CC This property returns sent messages that have the specified recipient in the Cc field. Display nameAlias

SMTP address

LegacyDN

Wildcard

Copy Code
-ContentFilter {(CC -eq 'ayla@contoso.com') -or (CC -eq 'tony@contoso.com')}
Expires This property returns messages that have a specified expiration time stamp. Date-Time stamp
Copy Code
-ContentFilter {Expires -lt '01/01/2010'}
HasAttachment This property returns messages with or without attachments. Boolean$true or $false
Copy Code
-ContentFilter {HasAttachment -eq $true}
Importance This property returns messages that have a specified importance level. 0 or “Low”1 or “Normal”

2 or “High”

Copy Code
-ContentFilter {Importance -eq 'high'}
-ContentFilter {Importance -eq 2}
IsFlagged This property returns messages that have been flagged by the user or Inbox rule. Boolean$true or $false
Copy Code
-ContentFilter {IsFlagged -eq $true}
IsRead This property returns messages that have been read or not read by the user. Boolean$true or $false
Copy Code
-ContentFilter {IsRead -eq $true}
MessageKind This property returns messages that are of the specified type. EmailMeetings

Tasks

Notes

Docs

Journal

Contacts

IM

Voicemail

Fax

Posts

RSSFeeds

Copy Code
-ContentFilter {MessageKind -eq Meetings}
-ContentFilter {MessageKind -ne Email}
MessageLocale This property returns messages that are of the specified locale. CultureInfo
Copy Code
-ContentFilter {MessageLocal -ne en-US}
-ContentFilter {MessageLocal -eq tr-TR}
Participants This property returns messages that have the specified recipient in the To, Bcc, or Cc fields. Display nameAlias

SMTP address

LegacyDN

Wildcard

Copy Code
-ContentFilter {(Participants -eq 'ayla@contoso.com') -or (Participants -eq 'tony@contoso.com')}
PolicyTag This property returns messages that have a policy tag. The Exchange store persists policy tags as GUIDs. Therefore, the string can contain either an explicit GUID value, which is then searched by the PR_POLICY_TAG, or a wildcard string.If the supplied value isn’t a GUID, the command uses Active Directory information to resolve names to GUIDs. StringWildcard
Copy Code
-ContentFilter {PolicyTag -ne '00000000-0000-0000-0000-000000000000'}
Received This property returns messages that were received by the recipient with the specified Received time stamp. Date-Time stamp
Copy Code
-ContentFilter {Received -lt '01/01/2010 9:00'}
{(Received -lt '01/01/2010') -and (Received -gt '01/01/2009')}
Sender This property returns messages that were received from the specified sender. Display nameAlias

SMTP address

LegacyDN

Wildcard

Copy Code
ContentFilter {Sender -eq 'tony'}
Sent This property returns messages that were sent by the recipient with the specified Sent time stamp. Date-Time stamp
Copy Code
-ContentFilter {Sent -lt '01/01/2010 9:00'}
-ContentFilter {(Sent -lt '01/01/2010') -and (Sent -gt '01/01/2009')}
Size This property returns messages that are of a specific size. B (bytes)KB (kilobytes)

MB (megabytes)

Copy Code
-ContentFilter {Size -gt 10KB}
Subject This property returns messages that have the specified string within the subject of the message. StringWildcard
Copy Code
-ContentFilter {Subject -like '*meeting*'}
To This property returns sent messages that have the specified recipient in the To field. Display nameAlias

SMTP address

LegacyDN

Wildcard

Copy Code
-ContentFilter {To -eq 'aylakol'}

 

 

 

 

This entry was posted in Exchange and tagged . Bookmark the permalink.