Just in case it matters (and I don't think it should), I'm running
these commands from my desktop, not on the server.
The zipped CSV file attached to the first search query early this
morning was basically empty. None of the others shows a log attached
to the email.
I've just tried it again - after a bit of STFW, I saw something
regarding date formats, so the second example here is with a more
usual date formate - but you'll see from the shell output that I'm
getting nothing.
search-mailbox -id "kurt buff" -searchquery {
"Sent:2015-06-07..2015-06-08 OR Received:2015-06-07..2015-06-08" }
-TargetMailbox "Discovery Search Mailbox" -TargetFolder "Kurt-Missing"
-LogLevel Full
RunspaceId : 860356ba-a81b-4106-8778-00f4a4bdad6a
Identity : example.com/ExampleUS/Users/Infrastructure/Kurt Buff
DisplayName : Kurt Buff
TargetMailbox : example.com/Users/DiscoverySearchMailbox
{D919BA05-46A6-415f-80AD-7E09334BB852}
TargetPSTFile :
Success : True
TargetFolder : \Kurt-Missing\Kurt Buff-2015-06-15 15:09:26
ResultItemsCount : 0
ResultItemsSize : 0 B (0 bytes)
search-mailbox -id "kurt buff" -searchquery { "Sent:06/07/2015"}
-TargetMailbox "Discovery Search Mailbox" -TargetFolder "Kurt-Missing"
-LogLevel Full
RunspaceId : 860356ba-a81b-4106-8778-00f4a4bdad6a
Identity : example.com/ExampleUS/Users/Infrastructure/Kurt Buff
DisplayName : Kurt Buff
TargetMailbox : example.com/Users/DiscoverySearchMailbox
{D919BA05-46A6-415f-80AD-7E09334BB852}
TargetPSTFile :
Success : True
TargetFolder : \Kurt-Missing\Kurt Buff-2015-06-15 15:14:15
ResultItemsCount : 0
ResultItemsSize : 0 B (0 bytes)
On Mon, Jun 15, 2015 at 2:27 PM, Michael B. Smith <mich...@smithcons.com> wrote:
> I'm running a UR of SP3 that is supposed to be released tomorrow, but other
> than that -- I dunno. I don't know what else could be different.
>
> What does the log say?
>
> -----Original Message-----
> From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com]
> On Behalf Of Kurt Buff
> Sent: Monday, June 15, 2015 1:35 PM
> To: excha...@lists.myitforum.com
> Subject: Re: [Exchange] Re: Exchange 2010 search-mailbox problem
>
> Nice - no errors while running it.
>
> So, I've tried it four times, altering the query slightly (for the dates
> only) each time.
>
> It produced a notification email in the respectuve folder, each time.
> However, while the first one had an attachment, it was only a .zip file with
> a CSV file and an XML file inside, and each were about 1k.
> No emails were included, unlike what was produced with the ECP.
>
> The next three (one for a different date, and two with a two-day date range,
> one of which went to a different folder (Kurt-Missing)), and each of the
> emails said "See attachments for additional logging information when full
> logging is enabled.", but there were no attachments, just the emails, and
> certainly no emails in the folder that were copies from my inbox.
>
> Any further thoughts?
>
>
> On Mon, Jun 15, 2015 at 3:05 AM, Michael B. Smith <mich...@smithcons.com>
> wrote:
>> Very close. Try this (which works for me):
>>
>>
>>
>> search-mailbox -identity "Kurt Buff" -SearchQuery {
>> "Received:2015-06-03" } –TargetMailbox "Discovery Search Mailbox"
>> -TargetFolder "Missing" -LogLevel Full
>>
>>
>>
>> From: listsad...@lists.myitforum.com
>> [mailto:listsad...@lists.myitforum.com]
>> On Behalf Of Kurt Buff
>> Sent: Wednesday, June 10, 2015 3:45 PM
>> To: excha...@lists.myitforum.com
>> Subject: Re: [Exchange] Re: Exchange 2010 search-mailbox problem
>>
>>
>>
>> I've verified that my DA account is a member of the proper group (I've
>> snipped down the output of the command from brevity), and I'm still
>> getting the error with the display name - unless I'm formatting the
>> command
>> incorrectly:
>>
>> [PS] C:\windows\system32>search-mailbox -identity "Kurt Buff"
>> -SearchQuery "Date:2015-06-03" -TargetMailbox "Discovery Search
>> Mailbox" -TargetFolder "Missing" -LogLevel Full The property keyword
>> isn't supported.
>> + CategoryInfo : InvalidArgument: (:) [], ParserException
>> + FullyQualifiedErrorId : 35063814
>> + PSComputerName : mailcas01p.example.com
>>
>>
>> [PS] C:\windows\system32>get-rolegroup "discovery management" | fl
>>
>> Members : {example.com/secureaccounts/kurt-admin}
>> SamAccountName : Discovery Management
>>
>>
>>
>> On Wed, Jun 10, 2015 at 12:02 PM, Michael B. Smith
>> <mich...@smithcons.com>
>> wrote:
>>
>> Sorry I missed this before. You should use the DisplayName: “Discovery
>> Search Mailbox”.
>>
>>
>>
>> You do need to be a member of the “Discovery Management” role group.
>>
>>
>>
>> You should also be able to use the LegacyExchangeDN or the
>> DistinguishedName.
>>
>>
>>
>> From: listsad...@lists.myitforum.com
>> [mailto:listsad...@lists.myitforum.com]
>> On Behalf Of Kurt Buff
>> Sent: Wednesday, June 10, 2015 1:33 PM
>> To: excha...@lists.myitforum.com
>> Subject: [Exchange] Re: Exchange 2010 search-mailbox problem
>>
>>
>>
>> OK - now I'm getting a bit PO'ed, and I figure I'm under some
>> misapprehension or other...
>>
>> I can do the following, and get good results, but no powershell
>> command works to get search results to the discovery mailbox - all return an
>> error.
>> I've tried everything that looks to me like it might be the name of
>> the discovery mailbox, and I get errors stating either that the
>> mailbox can't be found, or that 'the property keyword isn't supported'.
>>
>> So, yes, the ECP works, but I'd really like to understand why the
>> powershell commands don't work.
>>
>> Anyone?
>>
>>
>>
>> Kurt
>>
>>
>> [PS] C:\windows\system32>get-mailbox -anr disco -domaincontroller dc5
>>
>> Name Alias ServerName
>> ProhibitSendQuota
>> ---- ----- ----------
>> -----------------
>> DiscoverySearchMailbox... DiscoverySearchMa... maildb01p 50 GB
>> (53,687,091,200 bytes)
>>
>> [PS] C:\windows\system32>get-mailbox -anr disco -domaincontroller dc5
>> | fl
>>
>> RunspaceId :
>> 4d8a09da-7408-421c-a5aa-6daaf2090794
>> Database : Mailbox Database 0321391216
>> UseDatabaseRetentionDefaults : True
>> RetainDeletedItemsUntilBackup : False
>> DeliverToMailboxAndForward : False
>> LitigationHoldEnabled : False
>> SingleItemRecoveryEnabled : False
>> RetentionHoldEnabled : False
>> EndDateForRetentionHold :
>> StartDateForRetentionHold :
>> RetentionComment :
>> RetentionUrl :
>> LitigationHoldDate :
>> LitigationHoldOwner :
>> ManagedFolderMailboxPolicy :
>> RetentionPolicy :
>> AddressBookPolicy :
>> CalendarRepairDisabled : False
>> ExchangeGuid :
>> 4984f5e3-fc5e-4e78-aa19-d360f20abd00
>> ExchangeSecurityDescriptor :
>> System.Security.AccessControl.RawSecurityDescriptor
>> ExchangeUserAccountControl : AccountDisabled
>> MessageTrackingReadStatusEnabled : True
>> ExternalOofOptions : External
>> ForwardingAddress :
>> ForwardingSmtpAddress :
>> RetainDeletedItemsFor : 14.00:00:00
>> IsMailboxEnabled : True
>> Languages : {}
>> OfflineAddressBook :
>> ProhibitSendQuota : 50 GB (53,687,091,200 bytes)
>> ProhibitSendReceiveQuota : 50 GB (53,687,091,200 bytes)
>> RecoverableItemsQuota : unlimited
>> RecoverableItemsWarningQuota : unlimited
>> DowngradeHighPriorityMessagesEnabled : False
>> ProtocolSettings : {IMAP4§0§§§§§§§§§§§,
>> POP3§0§§§§§§§§§§§}
>> RecipientLimits : unlimited
>> IsResource : False
>> IsLinked : False
>> IsShared : True
>> LinkedMasterAccount : NT AUTHORITY\SELF
>> ResourceCapacity :
>> ResourceCustom : {}
>> ResourceType :
>> SamAccountName : SM_74a160694878400bb
>> SCLDeleteThreshold :
>> SCLDeleteEnabled :
>> SCLRejectThreshold :
>> SCLRejectEnabled :
>> SCLQuarantineThreshold :
>> SCLQuarantineEnabled :
>> SCLJunkThreshold :
>> SCLJunkEnabled :
>> AntispamBypassEnabled : False
>> ServerLegacyDN : /o=example/ou=Exchange
>> Administrative Group
>> (FYDIBOHF23SPDLT)/cn=Configuration/cn=Servers/cn=MAILDB01P
>> ServerName : maildb01p
>> UseDatabaseQuotaDefaults : False
>> IssueWarningQuota : unlimited
>> RulesQuota : 64 KB (65,536 bytes)
>> Office :
>> UserPrincipalName : DiscoverySearchMailbox
>> {D919BA05-46A6-415f-80AD-7E09334BB852}@example.com
>> UMEnabled : False
>> MaxSafeSenders :
>> MaxBlockedSenders :
>> ReconciliationId :
>> WindowsLiveID :
>> ThrottlingPolicy :
>> RoleAssignmentPolicy : Default Role Assignment Policy
>> SharingPolicy : Default Sharing Policy
>> RemoteAccountPolicy :
>> MailboxPlan :
>> ArchiveDatabase :
>> ArchiveGuid :
>> 00000000-0000-0000-0000-000000000000
>> ArchiveName : {}
>> ArchiveQuota : unlimited
>> ArchiveWarningQuota : unlimited
>> ArchiveDomain :
>> ArchiveStatus : None
>> RemoteRecipientType : None
>> DisabledArchiveDatabase :
>> DisabledArchiveGuid :
>> 00000000-0000-0000-0000-000000000000
>> QueryBaseDNRestrictionEnabled : False
>> MailboxMoveTargetMDB :
>> MailboxMoveSourceMDB :
>> MailboxMoveFlags : None
>> MailboxMoveRemoteHostName :
>> MailboxMoveBatchName :
>> MailboxMoveStatus : None
>> IsPersonToPersonTextMessagingEnabled : False
>> IsMachineToPersonTextMessagingEnabled : True
>> UserSMimeCertificate : {}
>> UserCertificate : {}
>> CalendarVersionStoreDisabled : True
>> ImmutableId :
>> PersistedCapabilities : {}
>> SKUAssigned : False
>> AuditEnabled : False
>> AuditLogAgeLimit : 90.00:00:00
>> AuditAdmin : {Update, Move, MoveToDeletedItems,
>> SoftDelete, HardDelete, FolderBind, SendAs,SendOnBehalf, Create}
>> AuditDelegate : {Update, SoftDelete, HardDelete,
>> SendAs, Create}
>> AuditOwner : {}
>> WhenMailboxCreated : 1/21/2014 5:57:13 PM
>> UsageLocation :
>> Extensions : {}
>> HasPicture : False
>> HasSpokenName : False
>> AcceptMessagesOnlyFrom :
>> {example.com/Users/DiscoverySearchMailbox
>> {D919BA05-46A6-415f-80AD-7E09334BB852}}
>> AcceptMessagesOnlyFromDLMembers : {}
>> AcceptMessagesOnlyFromSendersOrMembers :
>> {example.com/Users/DiscoverySearchMailbox
>> {D919BA05-46A6-415f-80AD-7E09334BB852}}
>> AddressListMembership : {}
>> Alias :
>> DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}
>> ArbitrationMailbox :
>> BypassModerationFromSendersOrMembers : {}
>> OrganizationalUnit : example.com/Users
>> CustomAttribute1 :
>> CustomAttribute10 :
>> CustomAttribute11 :
>> CustomAttribute12 :
>> CustomAttribute13 :
>> CustomAttribute14 :
>> CustomAttribute15 :
>> CustomAttribute2 :
>> CustomAttribute3 :
>> CustomAttribute4 :
>> CustomAttribute5 :
>> CustomAttribute6 :
>> CustomAttribute7 :
>> CustomAttribute8 :
>> CustomAttribute9 :
>> ExtensionCustomAttribute1 : {}
>> ExtensionCustomAttribute2 : {}
>> ExtensionCustomAttribute3 : {}
>> ExtensionCustomAttribute4 : {}
>> ExtensionCustomAttribute5 : {}
>> DisplayName : Discovery Search Mailbox
>> EmailAddresses :
>> {SMTP:DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}@exa
>> mple.com,X400:C=US;A= ;P=example;O=ZETUS;S=MsExchDiscoveryMailbox
>> D919BA05-46A6-415;}
>> GrantSendOnBehalfTo : {}
>> ExternalDirectoryObjectId :
>> HiddenFromAddressListsEnabled : True
>> LastExchangeChangedTime :
>> LegacyExchangeDN : /o=example/ou=Exchange
>> Administrative Group
>> (FYDIBOHF23SPDLT)/cn=Recipients/cn=DiscoverySearchMailbox
>> {D919BA05-46A6-415f-80AD-7E
>> MaxSendSize : 100 MB (104,857,600 bytes)
>> MaxReceiveSize : 100 MB (104,857,600 bytes)
>> ModeratedBy : {}
>> ModerationEnabled : False
>> PoliciesIncluded :
>> {e208c1ba-ed0c-4f67-a925-64f98b45e067,
>> {26491cfc-9e50-4857-861b-0cb8df22b5d7}}
>> PoliciesExcluded : {}
>> EmailAddressPolicyEnabled : True
>> PrimarySmtpAddress :
>> DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}@example.com
>> RecipientType : UserMailbox
>> RecipientTypeDetails : DiscoveryMailbox
>> RejectMessagesFrom : {}
>> RejectMessagesFromDLMembers : {}
>> RejectMessagesFromSendersOrMembers : {}
>> RequireSenderAuthenticationEnabled : False
>> SimpleDisplayName :
>> SendModerationNotifications : Always
>> UMDtmfMap :
>> {emailAddress:347268379732724624526939192205462641538023730933422852,
>> lastName
>>
>> FirstName:673924347268379624526939192205462641538023730933422852,
>> firstNameLas
>>
>> tName:673924347268379624526939192205462641538023730933422852}
>> WindowsEmailAddress :
>> DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}@example.com
>> MailTip :
>> MailTipTranslations : {}
>> PartnerObjectId :
>> 00000000-0000-0000-0000-000000000000
>> IsValid : True
>> ExchangeVersion : 1.0 (14.0.0.0)
>> Name : DiscoverySearchMailbox
>> {D919BA05-46A6-415f-80AD-7E09334BB852}
>> DistinguishedName : CN=DiscoverySearchMailbox
>> {D919BA05-46A6-415f-80AD-7E09334BB852},CN=Users,DC=example,DC=com
>> Identity :
>> example.com/Users/DiscoverySearchMailbox
>> {D919BA05-46A6-415f-80AD-7E09334BB852}
>> Guid :
>> 612529c6-1992-4c31-ab51-2ac34f2fa74c
>> ObjectCategory :
>> example.com/Configuration/Schema/Person
>> ObjectClass : {top, person, organizationalPerson,
>> user}
>> WhenChanged : 6/8/2015 1:49:07 PM
>> WhenCreated : 1/16/2014 2:11:25 PM
>> WhenChangedUTC : 6/8/2015 8:49:07 PM
>> WhenCreatedUTC : 1/16/2014 10:11:25 PM
>> OrganizationId :
>> OriginatingServer : dc5.example.com
>>
>> On Mon, Jun 8, 2015 at 12:21 PM, Kurt Buff <kurt.b...@gmail.com> wrote:
>>> All,
>>>
>>> Running Exchange 2010 SP3+, and am trying to find a couple of emails
>>> that seem to have gone missing. I'm running the command below from my
>>> workstation, and getting the error as shown.
>>>
>>> [PS] C:\windows\system32>Search-Mailbox -Identity "User Name"
>>> -SearchQuery "date:2015-06-03..2015-06-06" -TargetMailbox "Discovery
>>> Mailbox" -TargetFolder "Missing" -LogLevel Full The user or
>>> group"Discovery Mailbox" wasn't found. Make sure you typed it
>>> correctly.
>>> + CategoryInfo : InvalidArgument: (0:Int32)
>>> [Search-Mailbox], ManagementObjectNotFoundException
>>> + FullyQualifiedErrorId :
>>> AEFFD8B6,Microsoft.Exchange.Management.Tasks.SearchMailbox
>>> + PSComputerName : cas01p.example.com
>>>
>>>
>>> I've done a bit of STFW, and most pages are about difficulties
>>> upgrading. I've tried variations on the name of the discovery mailbox
>>> in the command below, including "DiscoveryMailbox" and
>>> "DiscoverySearchMailbox" and even
>>> "DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}" (which
>>> generates a different error - "The property keyword isn't supported").
>>>
>>> I have also tried unhiding the mailbox, but perhaps didn't wait long
>>> enough for replication
>>>
>>> Anyone have a clue for me?
>>>
>>>
>>> Kurt
>>
>>
>
>
