Mac Mail Not Showing Read Gmail Sent Items

In Exchange Server, you lot can employ the Search-Mailbox or New-ComplianceSearch PowerShell cmdlets (available in newer versions of Exchange Server and Exchange Online/Microsoft 365) to search for and delete email items from user mailboxes. For example, a user accidentally sent private data to colleagues in the system and did not have time to recall the message in Outlook. The information security department requires that an Substitution administrator delete this private e-mail from all user mailboxes in your Exchange arrangement/tenant.

Contents:

• Permissions Required to Search Exchange Mailboxes
• Search-Mailbox: Search and Delete Messages from Commutation User Mailboxes
• Keyword Search Examples for Substitution Mailboxes
• New-ComplianceSearch: How to Search and Delete Emails in Exchange?

The article applies to on-premises Exchange Server 2019/2016/2013 and 2010, too equally cloud-based Commutation Online (Microsoft 365).

Permissions Required to Search Substitution Mailboxes

The post-obit roles must be assigned to the administrator business relationship that searches for and deletes mailbox items:

• Mailbox Import Export
• Mailbox Search

Y'all can assign the roles using EAC or PowerShell. Connect to your on-prem Exchange Server using PowerShell and run the  commands:

New-ManagementRoleAssignment -User j.anderson -Role "Mailbox Import Export"
New-ManagementRoleAssignment -User j.anderson -Role "Mailbox Search"

In Exchange Online, you need to assign the following roles:

Add-RoleGroupMember "Discovery Management" -member max@woshub.com
New-RoleGroup "Mailbox Import-Consign Management" -Roles "Mailbox Import Consign"
Add together-RoleGroupMember "Mailbox Import-Consign Direction" -Member max@woshub.com

Add your account to the eDiscovery Admins group in Microsoft 365 Compliance Center

Afterward the roles have been assigned, restart the PowerShell session.

Search-Mailbox: Search and Delete Messages from Exchange User Mailboxes

You tin utilize the Exchange Admin Center (EAC) web interface or the Search-Mailbox PowerShell cmdlet to search email items in user mailboxes. This command allows you lot to search for emails in mailboxes by sure criteria, copy the found items to another mailbox, or remove them.

To search a user'due south mailbox for emails with a specific discipline, run the command:

Search-Mailbox -Identity k.peterson -SearchQuery 'Subject:"Annual Report"'
To search all mailboxes in the Substitution system, utilise the following control:
Get-Mailbox -ResultSize unlimited | Search-Mailbox -SearchQuery 'Subject area:"Almanac Report"'

When using the Search-Mailbox cmdlet in Exchange Online (Microsoft 365), a alert appears:

Warning:  On July one, 2020, the Search-Mailbox cmdlet is being retired and Microsoft Support volition no longer provide help.  Run into https://become.microsoft.com/fwlink/?linkid=2113221 to learn more. Alert: The Search-Mailbox cmdlet returns up to 10000 results per mailbox if a search query is specified. To return more than than 10000 results, employ the New-MailboxSearch cmdlet or the In-Place eDiscovery & Hold console in the Substitution Administration Center.

Microsoft recommends using the more powerful New-ComplianceSearch and New-ComplianceSearchAction mailbox search cmdlets (discussed below).

To copy the search results to a sure mailbox and binder, use the TargetMailbox or TargetFolder parameters. This will allow y'all to manually view the found emails in your Outlook later on the search is completed. Suppose you need to search for e-mail messages in the listing of mailboxes (given in users.txt) and copy the found items to the binder in the specific mailbox:

get-content users.txt | Get-Mailbox -ResultSize unlimited | Search-Mailbox -SearchQuery 'Subject:"Almanac Report"' -TargetMailbox sec_dept -TargetFolder "ExchSearchResult"

The –LogOnly -LogLevel Total pick means that search results must only be estimated without copying items to a target mailbox or deleting the messages. If this statement is used, a study containing the search results will be sent to the specified target mailbox. A report is an archived CSV file that lists mailboxes meeting the search criteria.

You tin estimate the search results using the –EstimateResultOnly parameter. Please, annotation that when using this option, yous don't demand to specify a target mailbox or folder.

Become-Mailbox | Search-Mailbox -SearchQuery 'Subject:"report"' -EstimateResultOnly|select Identity,ResultItemsCount,ResultItemsSize| Where-Object ResultItemsCount -gt 0

To delete the found email items, use the –DeleteContent parameter. Add together the –Force parameter to skip confirmation prompts

Permit'due south delete all electronic mail messages from the sender chiliad.peterson@woshub.com in all mailboxes on the specific Exchange server:

Get-Mailbox –Server berl-ex1 –ResultSize unlimited | Search-Mailbox -SearchQuery 'from:"k.peterson@woshub.com"' –DeleteContent –Strength

Before removing e-mail items from mailboxes using the -DeleteContent parameter, we strongly recommend that y'all view found emails using the -EstimateResultOnly or –LogOnly arguments.

To search only deleted items, add the –SearchDumpsterOnly parameter (to exclude search amidst the deleted items, add the -SearchDumpster:$false argument). If you need to exclude from the search outcome an archive mailbox, use the –DoNotIncludeArchive parameter.

The Search-Mailbox cmdlet has a significant limitation: it tin return only ten,000 elements. If this limit is exceeded it will render the error:

Sending data to a remote control failed with the post-obit error message: The total data received from the remote customer exceeded immune maximum. Immune maximum is 524288000.

In club to delete more than items, you will have to run the Search-Mailbox cmdlet several times or split the mailboxes into groups past mailbox databases or Exchange servers.

Get-Mailbox -Database berl-ex1 | Search-Mailbox –SearchQuery 'from:spam@spambot.org' -DeleteContent –Strength

Some other Search-Mailbox cmdlet problem is its poor operation. In the example of a big company, the search can take several days. In modern versions of Substitution Server and Microsoft 365, it'due south best to use the New-ComplianceSearch cmdlet (discussed beneath) to search for emails.

Keyword Search Examples for Commutation Mailboxes

Let's expect at examples of search queries to find electronic mail items using the SearchQuery parameter. The SearchQuery parameter processes query in the KQL format (Keyword Query Language)  https://docs.microsoft.com/en-us/sharepoint/dev/full general-evolution/keyword-query-language-kql-syntax-reference.

To discover and remove all emails containing the keyword "Secret" in the field of study from all users not from your domain:

Search-Mailbox -Identity yard.peterson -SearchQuery 'Subject:"Underground" and from<>"woshub.com"' -DeleteContent

Using the OR and AND logical operators, yous tin can combine more circuitous electronic mail search conditions.

Find and delete all emails with attachments larger than 20 MB:

Search-Mailbox -Identity one thousand.peterson -SearchQuery 'hasattachment:true AND Size >20971520' –DeleteContent

Tip. The size of the email items is specified in bytes, and the size of the entire e-mail item is counted, not just attachments. You can also specify the size in megabytes. In this case, the following syntax is used: -SearchQuery {Size -gt 30MB}

You can simultaneously search for the text in the discipline and body of the e-mail. For example, permit's find and delete all messages containing "New Year" in the subject or "brandy" in the electronic mail trunk.

Search-Mailbox chiliad.peterson -SearchQuery {Subject field:"RE:New Yr" OR torso:"brandy"} -DeleteContent -Force

Yous can search the mailboxes for specific items using the Kind argument. For example:

Meetings: -SearchQuery "Kind:meetings"
Contacts: -SearchQuery "Kind:contacts"

Or other Outlook elements:

• Electronic mail
• Meetings
• Tasks
• Notes
• Docs
• Journals
• Contacts
• IM

Searching emails by the specific recipient and sender:

-SearchQuery 'from:"ceo@woshub.com" AND to:"support-team@woshub.com"'

• Emails with attachments : -SearchQuery 'hasattachment:true'
• Emails that accept been read: -SearchQuery 'isread:fake'
• Search emails by size: -SearchQuery 'size>300000'

You can look for letters with the specific file as an zipper:

-SearchQuery 'zipper:"annual_report2021.pdf"'

Or by file blazon:

-SearchQuery 'attachment -similar:"*.docx"'

Y'all can search by send/receipt date, but at that place are several nuances. When using a date as a search criterion, you must consider the regional settings of your Substitution Server. For example, February 22, 2022 may be specified in ane of the following ways:

• 22/02/2022
• 02/22/2022
• 22-February-2022
• 22/February/2022

And if you see the error "The KQL parser threw an exception…" when running the Search-Mailbox command, it means that you are using the wrong engagement format.

To search for emails sent on a specific day, apply this query:

-SearchQuery sent:02/22/2022

If yous demand to specify the range of dates (you are looking for the email items received within a specified fourth dimension menstruum):

-SearchQuery {Received:01/04/2022..02/twenty/2022}

Here is some other example. Let's search for emails received after May ix:

-SearchQuery {Received:> $('05/09/2021')}

New-ComplianceSearch: How to Search and Delete Emails in Exchange?

In Substitution 2016/2019 and Exchange Online (Microsoft 365), y'all tin can use the new fashion to quickly search and delete email messages in user mailboxes by using the New-ComplianceSearch and New-ComplianceSearchAction cmdlets.

Microsoft recommends using these cmdlets to search emails in Exchange instead of the deprecated Search-Mailbox command.

Connect to M365 Security & Compliance Center:

Connect-IPPSSession

Let's try to search mailboxes for emails with a specific subject, sender, and engagement.

$Sender = "max@woshub.com"
$StartTime = "02/twenty/2022"
$EndTime = "02/22/2021"
$Subject = "report2022"

To create an e-mail search task based on the specified criteria, run:

New-ComplianceSearch -Name ContentSearch_Report2022 -ExchangeLocation all -ContentMatchQuery "sent>=$($StartTime) AND sent<=$($EndTime) AND sender:$($Sender) AND subject:$($Subject field)"

You lot tin specify search criteria in the -ContentMatchQuery attribute, similar to the -SearchQuery options on the Search-Mailbox cmdlet.

Often at this point an fault occurs:

New-ComplianceSearchAction: The term 'New-ComplianceSearchAction' is not recognized every bit the name of a cmdlet, office, script file, or operable program. Bank check the spelling of the name, or if a path was included, verify that the path is right and endeavor again.

Verify that yous have assigned all Commutation roles as described above.

Close the current PowerShell session and reconnect:

Go-PSSession | Remove-PSSession

To run this job:

Start-ComplianceSearch -Identity ContentSearch_Report2022

You lot take to wait for information technology to be done. You tin can get the electric current search status like this:

Go-ComplianceSearch -Identity ContentSearch_Report2022| FL proper name,items,size,jobprogress,status

To print search results to the console in Preview style:

New-ComplianceSearchAction -SearchName ContentSearch_Report2022 -Preview
(Get-ComplianceSearchAction ContentSearch_Report2022| Select-Object -ExpandProperty Results).Split(";")

If you desire to remove all found email items from user mailboxes, use the -Purge selection (available in Commutation Online):

New-ComplianceSearchAction -SearchName ContentSearch_Report2022 -Purge -PurgeType SoftDelete

If you want to make deleted emails recoverable by users, use the -PurgeType SoftDelete choice. Specify -PurgeType HardDelete to completely remove items from mailboxes.

At present you can delete the search results:

Remove-ComplianceSearch –Identity ContentSearch_Report2022

pattenthererace.blogspot.com

Source: http://woshub.com/search-mailbox-exchange/

Share this post