Search Messages Log and Delete

Hello,

I am trying to run the command below:

Search-Mailbox-Identity"User1"-SearchQuery"Subject:Review"-TargetMailbox"DiscoveryMailbox"-TargetFolder"Unknown"-LogLevelFull 

and I am getting the error below:

The user or group"DiscoveryMailbox" wasn't found. Make sure you typed it correctly.
    + CategoryInfo          : InvalidArgument: (0:Int32) [Search-Mailbox], ManagementObjectNotFo
   undException
    + FullyQualifiedErrorId : [Server=BLUPR09MB0819,RequestId=-8e4f-14bad131b1
   f6,TimeStamp=7/25/2015 2:56:00 AM] [FailureCategory=Cmdlet-ManagementObjectNotFoundException 
  ] 7B6DEC1A,Microsoft.Exchange.Management.Tasks.SearchMailbox
    + PSComputerName        : outlook.office365.com

My question is how will I create or where will I see the Target Mailbox "DiscoveryMailbox?" including, the TargetFolder? My purpose is to review the spam email that some of our users received before deleting it from their mailbox.  I already setup the Management Role Group In EAC.

Can someone help, thanks.

July 24th, 2015 11:11pm

Hello Alopez,

The real issue here is there is no mailbox with name DiscoveryMailbox doesn't exists.

Run the following cmdlet and see if the mailbox exists

Get-Mailbox -Identity 'DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}'
If returned you result, substitute the same name and do a search query
Free Windows Admin Tool Kit Click here and download it now
July 25th, 2015 2:44am

Hello Manu,

I ran the script:

Get-Mailbox -Identity 'DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}'

and got this result:

PS C:\Windows\system32> Get-Mailbox -Identity 'DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}'

Name                                       Alias                ServerName       ProhibitSendQuota               
----                                           -----                ----------       -----------------               
DiscoverySearchMailbox... DiscoverySearchMa... Tn1pr11p9b013    50 GB (53,687,091,200 bytes)  

I could not see the whole detail? discoverySearchMailbox...

The I ran this script again, not sure if I am doing it right:

Search-Mailbox-Identity"User1-SearchQuery'Subject:"ReviewSpam"'-TargetMailboxDiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852} -TargetFolder"SearchAndDeleteLog"-LogOnly-LogLevelFull

Then I got this result:

PS C:\Windows\system32>
Search-Mailbox -Identity "User1" -SearchQuery 'Subject:"Review"' -TargetMailbox DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852} -TargetFolder "SearchAndDeleteLog" -LogOnly -LogLevel Full
A positional parameter cannot be found that accepts argument
'D919BA05-46A6-415f-80AD-7E09334BB852'.
    + CategoryInfo          : InvalidArgument: (:) [Search-Mailbox], ParameterBindingException
    + FullyQualifiedErrorId : PositionalParameterNotFound,Search-Mailbox
    + PSComputerName        : pod51045psh.outlook.com

I believe the parameter should be different but couldn't see the rest of the information given.

Then I removed the longer long parameter and just left the DiscoverySearchMailbox and I got this result:

PS C:\Windows\system32>
Search-Mailbox -Identity "User1" -SearchQuery 'Subject:"Review"' -TargetMailbox DiscoverySearchMailbox -TargetFolder "SearchAndDeleteLog" -LogOnly -LogLevel Full

WARNING: The Search-Mailbox cmdlet returns up to 10000 results per mailbox if a search query is sp
ecified. To return more than 10000 results, use the New-MailboxSearch cmdlet or the In-Place eDisc
overy & Hold console in the Exchange Administration Center.

PS C:\Windows\system32>
Search-Mailbox -Identity "User1" -SearchQuery 'Subject:"Review"' -TargetMailbox DiscoverySearchMailbox -TargetFolder "SearchAndDeleteLog" -LogOnly -LogLevel Full

WARNING: The Search-Mailbox cmdlet returns up to 10000 results per mailbox if a search query is sp
ecified. To return more than 10000 results, use the New-MailboxSearch cmdlet or the In-Place eDisc
overy & Hold console in the Exchange Administration Center.

The operation couldn't be performed because object 'User1' couldn't be
found on 'BLUR09.PR110A001.prod.outlook.com'.
    + CategoryInfo          : InvalidArgument: (0:Int32) [Search-Mailbox], ManagementObjectNotFo
   undException
    + FullyQualifiedErrorId : [Server=CR09MB0828,RequestId=5sfsfs8-6239-4fdfd4-b9c9-316dfd41a
   72,TimeStamp=7/25/2015 4:53:47 PM] [FailureCategory=Cmdlet-ManagementObjectNotFoundException 
  ] 5AF276B9,Microsoft.Exchange.Management.Tasks.SearchMailbox
    + PSComputerName        : pod51045psh.outlook.com

What am I missing here? Thanks.

July 25th, 2015 1:06pm

Hi,

Try with GUID instead of username 'User1'

Get-Mailbox User1 |fl *guid*

Free Windows Admin Tool Kit Click here and download it now
July 25th, 2015 3:17pm

I ran the script you recommended ManU and I got this result:

PS C:\Windows\system32> Get-Mailbox User1 |fl *guid*
Creating a new session for implicit remoting of "Get-Mailbox" command...

ExchangeGuid           : 8c4545654-68c6-44545-b445c9-65a348ae6fa44
MailboxContainerGuid   :
AggregatedMailboxGuids : {}
ArchiveGuid            : 00000000-0000-0000-0000-000000000000
DisabledArchiveGuid    : 00000000-0000-0000-0000-000000000000
Guid                   : 0d7e374-b87900-499d2-ab6-63d2b9eeeed83

How do you read this?  What am I trying to accomplish here?  Thanks.


July 25th, 2015 8:49pm

Hello,

Now you can run the following cmdlet

Search-Mailbox -Identity "0d7e374-b87900-499d2-ab6-63d2b9eeeed83" -SearchQuery 'Subject:"Review"' -TargetMailbox DiscoverySearchMailbox -TargetFolder "SearchAndDeleteLog" -LogOnly -LogLevel Full
Free Windows Admin Tool Kit Click here and download it now
July 25th, 2015 11:02pm

Hello ManU,

I ran the command that you suggested and still unable to do the search for this mailbox? It says, The user or group"DiscoverySearchMailbox" wasn't found...

PS C:\Windows\system32> Search-Mailbox -Identity "0ade34-b700-49d2-ab6-63db9eed783" -SearchQuery 'Subject:"Review"' -TargetMailbox DiscoverySearchMailbox -TargetFolder "SearchAndDeleteLog" -LogOnly -LogLevel Full

WARNING: The Search-Mailbox cmdlet returns up to 10000 results per mailbox if a search query is sp
ecified. To return more than 10000 results, use the New-MailboxSearch cmdlet or the In-Place eDisc
overy & Hold console in the Exchange Administration Center.

The user or group"DiscoverySearchMailbox" wasn't found. Make sure you typed it correctly.
    + CategoryInfo          : InvalidArgument: (0:Int32) [Search-Mailbox], ManagementObjectNotFo
   undException
    + FullyQualifiedErrorId : [Server=BL09M8B089,RequestId=c77d2-996-1de-ae71-a1b6d43f
   94,TimeStamp=7/26/2015 8:37:20 AM] [FailureCategory=Cmdlet-ManagementObjectNotFoundException 
  ] 503A6A41,Microsoft.Exchange.Management.Tasks.SearchMailbox
    + PSComputerName        : outlook.office365.com

What should I do now?

July 26th, 2015 4:45am

Hi,

The DiscoveryMailbox in the example from the Search-Mailbox document is a discovery mailbox that you need to create. Its not the DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852} mailbox. If you really want to copy the results to this mailbox, you can use the following command.

Search-Mailbox Identity User1 -SearchQuery'Subject:"ReviewSpam"' TargetMailbox DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852} TargetFolder "SearchAndDeleteLog" LogOnly LogLevel Full

But I dont suggest to use the DiscoverySearchMailbox as the target mailbox, because its a system mailbox.

I suggest to create a new Discovery Mailbox to store the result or create a user mailbox.

https://technet.microsoft.com/en-us/library/dd638177(v=exchg.150).aspx

Best Re

Free Windows Admin Tool Kit Click here and download it now
July 31st, 2015 3:52am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics