I am unable to use searchquery in powershell to manage email

Timothy Taylor
Timothy Taylor used Ask the Experts™
on
I have a 2 node DAG Exchange 2013 CU19.
I am trying to delete any email older than 1/1/2016 for a specific user, but no matter what I do, I get nothing from searchquery filtering.
I Have confirmed Roll group Membership for Discovery Management and Mailbox Import Export.
I tried every format of double and single quotes for the date, and could not find anything.
I then tried to remove something from my mailbox, and get the same thing.
I sent me an email with subject test, and can not find it either.

I have tried:
search-mailbox -identity ttaylor -searchquery subject:test -estimatresulteonly
search-mailbox ttaylor -searcquery subject:test -estiamateresultonly
search-mailbox -identity ttaylor -searchquery "subject:test" -estimatresulteonly
search-mailbox ttaylor -searcquery "subject:test" -estiamateresultonly

I always get the same output
RunspaceId       : 304008d0-fa23-40d9-8867-d6ea567d5b9c
Identity         : Domain/ou/Tim Taylor
TargetMailbox    :
Success          : False
TargetFolder     :
ResultItemsCount : 0
ResultItemsSize  : 0 B (0 bytes)

Any suggestions
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
timgreen7077Exchange Engineer
Distinguished Expert 2018

Commented:
You can run the following cmdlets and see if it gives you the results you are looking for:

Search-Mailbox -Identity "ttaylor" -SearchQuery "Received:<$('01/01/2016')" 2016 -targetmailbox "your mailbox" -targetfolder inbox -LogOnly

This will pull the results and send the log to your mailbox's inbox so you can review it, but if you want to delete it run the following:

Search-Mailbox -Identity "loanresolution" -SearchQuery "Received:<$('01/01/2016')" –DeleteContent –confirm:$false

Author

Commented:
The command failed as ttaylor is my mailbox, and it can not search my mailbox and report to it.
I did change the command to search lwilson and report to mine, but it fails.

RunspaceId       : b1863c7d-ea62-4397-8b6f-c08f74ec7bd0
Identity         : ppok.com/Executive Team/Users/Lonny Wilson
TargetMailbox    : ppok.com/PPOK EMPLOYEES AND WORKSTATIONS/INFORMATION TECHNOLOGY/SYSTEMS AND NETWORK/SYSTEMS
                   ENGINEER 2/Employee/Tim Taylor
Success          : False
TargetFolder     : \inbox\
ResultItemsCount : 0
ResultItemsSize  : 0 B (0 bytes)

Author

Commented:
second command fails as well.
I am looking at an email in my inbox from 4/18/2016 and I run the following command
Search-Mailbox -Identity "ttaylor" -SearchQuery "Received:<$('04/19/2016')" –DeleteContent –confirm:$false

I get an other success false, resultitemscount 0 resultitemsize 0
To verify if this is a query-related problem, please check if
Search-Mailbox -Identity "ttaylor" -SearchQuery "kind:email" -EstimateResultOnly

Open in new window

ends with a success. If the cmdlet above still does not return any items, it might be a permissions issue (unlikely, since you mentioned you have assigned them). I would still check if a member of Organization Management with "Mailbox Import Export" runs into this issue as well.
If still no luck, please let me know, I'll do more in-depth investigation.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial