Using ECP doing a Discovery request.   I've listed some keywords seperated by OR, listed a few mailboxes to search, and set a START date that I wanted the search to go back to.

Results include e-mails sent prior to the START date specified.

I see where there have been syntax issues is command line multi-mailbox searches but I'm doing a simple search in the web interface.  Anyone else experience this?  Is this a bug or am I miss interpreting how this

Hi Meyer,

According to the description from the Technet article (http://technet.microsoft.com/en-us/library/dd335072(v=exchg.141).aspx), I collect some information for your reference:

Multi-Mailbox Search uses the content indexes created by Exchange Search. The Exchange Control Panel (ECP) provides an easy-to-use search interface for non-technical personnel such as legal and compliance officers, records managers, and human resources (HR) professionals.

Based on my understand, the Search function in ECP is just a multi-mailbox search interface.

It is a by design behavior.

Please correct me if there is any misunderstanding.

Thanks

Mavis

Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

Yes, and from the webpage that you provided it discusses "Date range":

• Date range   By default, Multi-Mailbox Search doesn't limit searches by a date range. To search for messages sent during a specific date range, you can narrow the search by specifying the start and end dates. If you don't specify an end date, the search will return the latest results every time you restart it.

I provided a START date, and left the END date blank so that it would return the latest results.   But, items SENT from prior to the START date were included in the results.  This is not what I expected for results.

Hi Meryer,

Please double check the Date format, by default it is mm/dd/yyyy.

Thanks

Hi,

Any update?

Thanks

Mavis

Today I again ran into issues with this, a customer wanted to search multiple mailboxes with keywords and a specific date range.   Using Exchange Control Panel to do a Discovery search returned results SENT outside of the dates specified.  I was searching about 1200 mailboxes, looking for two keywords with an OR, and a date range of about three weeks.   Results include e-mails from years prior to the range.

Any feedback on this or anyone else seeing this behavior?

1. are your systems patched 100%?

2. If you include an END date does it work as desired or do items prior still appear

3. Can you include a screen shot  to show how the search is configured with all options?

4. Whats you local, i.e. US, Europe?  Just thinking of a past issue with date formats that arose in 2010

1. Yes, the system is fully patched.

2. No, I specify a START date and an END date and results include items SENT outside of this timeframe.

3. Here is the screen shot:  I have e-mails from 2014 in the results.

5. CDT

ok a few more Q's

1. Can you get the correct results using Powershell without issue?

2. I am setting up a test on this, therefore please tell me all the fields your using, i.e. are you search all mailboxes or just specific, defining, the FROM and TO, Keywords etc

3. Re  your answer of CDT, are you in the USA then?

1. Unknown at this time.  To this point we've used Outlooks ability to search/sort by Sent date and a custom search folder setup with no criteria to get to the results. 

2. The mailboxes we are searching are in a single dynamic distribution group that has roughly 1200 mailboxes, we have 20k mailboxes.

Two keyword strings ("blue car" OR Chevrolet) as an example.

And the time frame.   Only e-mails, no FROM/TO specified.  Results copied to a discovery mailbox

3. Yes, CDT is Central Daylight Time.

ok so;

1. Your right its goofy as shit, i.e. I put in a date range of 8/12 to 8/13 and I got stuff back from 8/11

2. Although looking at this I wasnt getting everything back from 8/11 only about 19 items out of hundreds for the mailbox I was searching

3. All of that said I think whats happening is that Exchange is using the UNIVERSAL TIME vs local time and here is an article stating why thats a good thing http://d4discovery.com/discover-more/2014/2/all-parties-should-agree-to-the-same-time-zone-early-in-ediscovery#sthash.nbnhcwYj.dpbs

4. and another stating the the date time info in Exchange is stored in UTC https://technet.microsoft.com/en-us/library/Dd335144%28v=EXCHG.150%29.aspx?f=255&MSPPError=-2147217396

So I think this is the issue you are running into and based upon my testing this lines up perfectly since I am in PST and the offset from UTC to PTC is seven (7) hours and all the messages that came back as being created on 8/11 were within that 7 hour window.

IMHO stupid to not let you designate what you are really looking for, i.e. UTC vs your own time zone but I'm going to assume MS is aligning

If you want a 3rd party utility to get exactly what you want check out our DigiScope product as it searches the time in your local not UTC

Uh, time zone difference wouldn't account for items from more than six months outside of the timeframe specified.

Right?

No, I'm not interested in a 3rd party solution, I'd like the solution that I bought to work as expected.

No thats another issue then if your getting such a wide variance.

I am not able to replicate therefore I would think it would be either patch or index related.  With that said does this issue persists regardless of the database you are searching?  If so it might be patch related, else if it varies by DB I would suggest rebuilding the indexes on the offending DB's