Script automates Exchange 2010 SP1 discovery

I don’t envy compliance officers whose job it is to perform manual searches for items that computers were supposed to find automatically. And although Exchange Server has a structured hierarchy, it’s not always easy to find what you need, especially if you need to use a slew of different keywords.

Generally, if you want to run a search across multiple Exchange 2010 SP1 mailboxes, you would use the

    Requires Free Membership to View

Multi-Mailbox Search function, found in the Exchange Control Panel (ECP). This search tool harvests results and then sends them to a discovery mailbox, which has the sole purpose of housing these results.

This method works well if you’re performing an occasional search, but what if you need to generate weekly or daily reports? In those cases, automation is key.

The Exchange team released the SearchMailboxes.ps1 PowerShell script, which allows you to automate multi-mailbox searches. The script comes with a setup file that creates a scheduled task to run searches.

The SearchMailbox.ps1 script runs every Monday by default, but you can edit its search.config file settings to run it at other times. The search.config file also lets you specify the name of the discovery mailbox where messages will reside and the search string you should use when you run your search.

In my opinion, the script is incredibly meticulous, especially with regard to adhering to search start dates before starting new searches . According to the Exchange blog, for example, "For subsequent searches, the start date is automatically obtained from the previous search. If the previous search is successful, its end date is used as the start date for the new search. If the previous search failed, the start date specified in that search is used as the start date for the new search. This ensures that you don't miss any messages due to a failed search.”

Note: In this explanation, a failed search doesn’t mean a search that didn't return any results. It actually means a search that may have been aborted due to a server or network issue.

Serdar Yegulalp
has been writing about computers and IT for more than 15 years for a variety of publications, including SearchWinIT.com, SearchExchange.com, InformationWeek and Windows magazine.

This was first published in March 2011

There are Comments. Add yours.

TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.