A Multi-Mailbox Search can be initiated through the ECP, or by using the EMS, assuming you have been added to the Discovery Management RBAC role group. If you are performing a search
across all mailboxes in your organization that may return a large
number of items, Exchange Server 2010 SP1 provides the option to
estimate the search result size. This option is selected initially by default, as shown in Figure 3; it is recommended that you keep this selection, as this will provide you with an estimate of the size of the search
results, thus allowing you to determine beforehand that the disk
volumes holding the mailbox database and transaction logs have
sufficient free space to hold the expected search results.
In addition, for searches that will return a large number of items Exchange Server 2010 SP1 also provides the Copy Only One Instance Of The Message option as shown in Figure 2. This will reduce the size of the results by removing any duplicate messages from the search results.
The following example creates a search using the EMS; this search covers the period 1 January 2010 to 31 December 2010, looks for e-mail items only, searches for e-mail that contains the phrases "last quarter" or "Project Contoso" or the word merger, and returns unsearchable items as well:
New-MailboxSearch -Name "Merger Search" -StartDate "1/1/2010" -EndDate "12/31/2010"
-TargetMailbox "Discovery Search Mailbox" -SearchQuery '"last quarter" OR merger OR
"Project Contoso"' -MessageTypes Email -IncludeUnsearchableItems -LogLevel Full
A search object is created in
the Exchange Server 2010 system mailbox when you perform a search;
manipulating this object allows you to start, stop, modify, and remove
the search.
The following parameters are applied when performing a discovery search:
Keywords Keywords and phrases can be specified to focus the search.
Messages To Or From Specific E-Mail Addresses You can limit your search by specifying the senders or recipients
of messages to search for. Senders or recipients can be specified by
e-mail address, display name, or domain (such as @contoso.com).
Date Range
Searches aren't limited by date range by default, but you can specify
start and end dates to narrow the search. If you define a start date
but no end date, the latest results will be returned each time the
search is restarted.
Mailboxes To Search
You can scope the search to include all mailboxes in the organization,
or limit the search by specifying mailboxes to include. Distribution
groups can also be specified; this will include mailboxes that are
members of the distribution group.
Personal Archive Multi-Mailbox Search includes personal archives by default. If you want to exclude personal archives, you must create or modify the search using the EMS; this option is not available via the ECP.
Message Types Your search can be configured to include all message types or it can be limited to selected types. You can select to search the following message types:
Attachments Attachment types supported by Exchange Search are included in the search. Additional file types can be supported by installing search filters (also known as iFilters) for that file type on the Mailbox servers.
Include Items That Can't Be Searched
You can specify items that can't be indexed by Exchange Search in the
search results. Reasons for unsearchable items can include file types
for which no search filters are installed, filter errors, and encrypted messages such as those encrypted by S/MIME.
Safe List
Exchange Server 2010 setup creates a safe list of file types that
contain content that can't be indexed by Exchange Search; mailbox items
containing these items are not returned in the list of failed items.
These file types include image files such as bitmaps and multimedia files such as .mp3 and .mpg files.
IRM-Protected Messages Messages protected using AD
RMS can be indexed and returned in search results if Exchange Server
2010 has been configured for AD RMS integration.
Note:
If
Exchange Search fails to index an IRM-protected message, that item is
not returned in the failed items list. You can compensate for this by
creating a second discovery search to return messages with .rpmsg attachments by using the query string attachment:rpmsg.
Search results are copied to
the discovery mailbox specified when the search was created, in a
folder with the same name as the search. Underneath this folder,
subfolders are created for each searched mailbox, provided the Copy
Only One Instance Of The Message option has not been selected for the search. These folders are named using the mailbox's display name and the date and time the search
was created. In each mailbox folder, messages are copied to a folder
that has the same name as their location in the user's mailbox. The
following example of this folder structure shows a search named Merger Search that returned results in the Inbox of the primary mailbox of a user named Tamer Salah:
Merger Search > Tamer Salah -25/2/2010 9:57:10 PM > Primary Mailbox > Inbox
The search results as they appear in Outlook 2010 are shown in Figure 4. If the Copy Only One Instance Of The Message option was selected for the search,
then all results are copied to a single folder; in this example, a
single folder named Results and the date and time the search was
created would be created underneath the Merger Search folder.
Finally, if a discovery mailbox other than the default Discovery
Search Mailbox is specified for the search, mailbox access permissions
must be configured separately for authorized users to access the
mailbox. These users can access the mailbox with either OWA or Outlook.
Access to the default Discovery Search Mailbox is granted through
adding the authorized user to the Discovery Management RBAC role group.
