Wednesday, 4 November 2015

Search-Mailbox with date range and time range

The Search-Mailbox command can be used with a date range to get emails that match a particular criteria and move or copy to a different mailbox.

To specify the date range, you can separate your dates by .. so that Windows Query Language knows to find the emails within the dates. You can also specify the time which is quite helpful.

In this example, I’ve sent 100 emails from sales@sales.com to the mailbox finance1 between 10:00 and 13:00 on 3rd November and want to move these emails to the finance2 mailbox. Run the below command which will work on Exchange 2010, 2013 and 2016:

Get-Mailbox finance1 | Search-Mailbox -SearchQuery {from:sales@sales.com AND Received:"03/11/2015 10:00..03/11/2015 13:00"} -TargetMailbox finance2 -TargetFolder "Query1"

image


Above you can see the output where it shows that the 100 emails have been moved to the target mailbox.

6 comments:

  1. I get error!

    Please adjust the date time. Make sure it is in the correct format.
    + CategoryInfo : InvalidArgument: (:) [], ParserException
    + FullyQualifiedErrorId : 45D3E34A

    ReplyDelete
  2. Get-Mailbox JoeWhite | Search-Mailbox -SearchQuery {Kind:email AND To:JaneBlack@blogspot.com AND Sent:=11/9/2016 00:31..11/10/2016 22:20} -TargetMailbox JimAdmin -TargetFolder "DateTimeQuery1" -LogLevel Full

    NOTE: EXCHANGE 2010 EXAMPLE

    ReplyDelete
  3. this doesn't work. anything else i need to do?

    ReplyDelete
  4. is it possible to search emails with sender domain ?

    ReplyDelete
  5. There are a few other webpages with different examples of a date range value for -SearchQuery. This example is the only one that provides accurate results. I would recommend doing a -LogOnly to make sure that you are capturing only what you want to. The other examples captured emails outside the specified range.
    Thanks

    ReplyDelete
  6. This doesn't quite work as presented. It only looks at the date portion, not the time of day portion. In your example, if there has also been 50 emails sent *before* 9:00, they would also be captured and returned.

    Does anyone know how to include the time as well?

    ReplyDelete