We are getting more and more requests to perform a search to gather all emails on a particular topic and provide those results to a group of people. From the TechNet article referenced below, these are some of the reasons why you might find a need to search across mailboxes in Exchange.
- Legal discovery Complying with legal discovery requests for messaging records is one of the most important tasks for organizations involved in lawsuits. Without a dedicated tool, searching messaging records within several mailboxes that may reside in different mailbox databases can be a time-consuming and resource-intensive task. Using Multi-Mailbox Search, you can search a large volume of e-mail messages stored in mailboxes across one or more Exchange 2010 servers, and possibly in different locations.
- Internal investigations Multi-Mailbox Search can help you facilitate requests from managers or legal departments as part of internal investigations.
- Human Resources monitoring Multi-Mailbox Search can help you facilitate HR requests, such as standard e-mail monitoring requirements or a specific search.
Exchange has this functionality if you own the Exchange Enterprise CALS for all of the mailboxes on the server. The steps involved are these:
- Create a Discovery Search mailbox. This mailbox will hold the search results
- Enter your search criteria and run it
- Assign Full Mailbox permissions to the people that need to see the results and assist the users in adding the discovery search mailbox to Outlook
The search can get very granular, permissions can get very complex and there are a ton of options with which to run this process. I’m going to show a basic search which is what you will use in most cases. If you’d like to get into the nitty gritty TechNet is your best source. Start here: http://technet.microsoft.com/en-us/library/dd335072(v=exchg.141).aspx
For your ordinary search needs…
1. Create a Discovery Search Mailbox. This is a powershell only item. The command is New-Mailbox “Discovery Mailbox1” –Discovery –UserPrincipalName “firstname.lastname@example.org” Where Discovery Mailbox1 is the name that you want to call this mailbox by. I often use the date or in a recent the case, the name of the project that we wanted to gather up all emails from. What ever you name it, just make sure that it is obvious to all parties what it is. UserPrinicipalName is the name of the user for this mailbox. In Exchange every mailbox must have a user, this command will create the user for you in AD. I suggest naming the user the same as the discovery mailbox.
You will get a result from PowerShell like the one below.
And in Exchange you will now see the new mailbox. This mailbox has a 50GB quota by default. Keep that in mind as you are performing the search. May G-D have mercy on your soul and those of the people that have to read the search results if the mailbox exceeds 50GB. I wouldn’t wish the fate of having to read that much email on my worst enemy.
Screenshots from http://theucguy.net/discovery-mailbox-in-exchange-2010/
2. Enter your search criteria and run it. I find these unnecessarily buried and difficult to find. You find it in OWA and here’s how you get there. Log into OWA as an administrator. Go to Options, then change from Manage Myself to Manage My Organization. Move to Role & Auditing. Select Discovery Management role and add your administrator account to this group. This is required so that you can see and use the discover tools.
Logoff and back on again and you will now see the Discovery tools option.
To perform a search click NEW and enter your search criteria into the form.
The first item you come to in the form is keywords. This is the most important part of the whole form because here you are telling it what to search for. As an external consultant I always ask the client for the list of terms to search for. As noted in the screenshot below you will enter AND, OR or NOT between the search terms you list. After an initial search has been run, I always ask the client to review the results to determine whether the search is accurate and contains what they need. We can always change the search terms and run it again.
The rest of the form is very straight forward. It just wants to know which mailboxes to search (or all of them) and which users to include, exclude or not and what date range to include or not to limit it by date. Most often you will find that you will not be limiting the search by date or user.
The final part of the form is a little bit important. Here is where you will name the search. As before when I recommended that you name the user and search mailbox the same. I would name the search the same too to make it easy to keep track of.
If you select the radio button for Estimate the search results, all you will get is an estimate. The search mailbox won’t actually have anything in it. To move the search results into the search mailbox you have to select the Copy the search results to the destination mailbox radio button and then Browse to the mailbox you created.
Note the Enable deduplication checkbox. As you know when you send email to multiple people you get a lot of copies of the same email. This checkbox will eliminate those. However, if this is a legal issue that you are gathering the data for you probably will want to uncheck that box. Check with your client.
Now run the search! It will take a little while but actually it is quite quick. When finished you’ll find a nice little report in the right hand column that tells you how many emails and whose mailboxes they were in.
3. Assign Full Mailbox permissions to the people that need to see the results and assist the users in adding the discovery search mailbox to Outlook
Back in the Exchange Management console select the mailbox and Click Manage Full Access from the right column (near the bottom). Then add the users that need access to the search results mailbox.
Go to the users and assist them in adding an additional mailbox to Outlook so they can review the results.
Are you not a member of SMBKitchen ASP? Join up. $300 for new members. http://helpdesk.thirdtier.net/. Just register for an account then proceed to payments, click buy more support and add the ASP to your cart. Our goal is to help IT firms be more aware, be better consultants and survive in the new era.