Forum Discussion
Roger Roger
May 14, 2018Iron Contributor
search mailbox with key word
Hi experts User1 has sent an email to User2 on May 01, and there was lot of email communications happened that day between user1 and user2. User1 says that he sent an email on May01 , user2 says th...
VasilMichev
May 14, 2018MVP
You cannot search the message trace logs by keyword. You can do an eDiscovery search or use the Search-Mailbox cmdlet, but that will not show you the mail flow info, only whether the message is currently present in that mailbox.
- Roger RogerMay 14, 2018Iron Contributor
if i need to search email body with the word rejected. will the below syntax work.
Get-Mailbox -Identity User2| Search-Mailbox -SearchQuery {from:user1@domain.com AND Received:"5/1/2018 12.00..05/5/2018 23:59"} -TargetMailbox <rejected> -TargetFolder "User1_User2_search05052018" -LogOnly -LogLevel Full
Get-Mailbox -Identity User1 | Search-Mailbox -SearchQuery {to:user2@domain.com AND Send:"5/1/2018 12.00..05/5/2018 23:59"} -TargetMailbox <rejected> -TargetFolder "User1_User2_search05052018" -LogOnly -LogLevel Full
- VasilMichevMay 15, 2018MVP
It should work, however this will not tell you when the message arrived in the mailbox or any other related mail flow information. For that you need the message trace data.
- Roger RogerMay 15, 2018Iron Contributor
can any one correct the below two syntax
Get-Mailbox -Identity User2| Search-Mailbox -SearchQuery {from:user1@domain.com AND Received:"5/1/2018 12.00..05/5/2018 23:59"} -TargetMailbox <rejected> -TargetFolder "User1_User2_search05052018" -LogOnly -LogLevel Full
Get-Mailbox -Identity User1 | Search-Mailbox -SearchQuery {to:user2@domain.com AND Send:"5/1/2018 12.00..05/5/2018 23:59"} -TargetMailbox <rejected> -TargetFolder "User1_User2_search05052018" -LogOnly -LogLevel Full
This below syntax works but i am not getting the results. what ever is body its show success is true.
Get-Mailbox -Identity user2@mydomain.com | Search-Mailbox -SearchQuery {Body:"*TestEmail*" AND From:user1@mydomain.com AND Received:"05/15/2018 13:00..05/15/2018 16:05"} -EstimateResultOnly