Is it possible to search multiple keywords and phrases using search-mailbox -searchquery like the following all at once:
(cat OR dog Or pig OR snake) <--any emails with any of those words in the body
and
(cat AND dog) <---any emails with both of those words in the body
or
(cat AND pig) <---any emails with both of those words in the body
or
(cat AND snake) <---any emails with both of those words in the body
or
(pig AND snake) <---any emails with both of those words in the body
etc...etc...
I need to search all emails containing single keywords and combined keywords sent or received since 11/01/2010 of users in certain OU's.
This is the code showing the logic but can't quite figure out the proper format to do this. Wanted to run just 1 search if possible instead of several.
Get-Mailbox -ResultSize unlimited -OrganizationalUnit MyOU -RecipientTypeDetails UserMailbox | search-mailbox -TargetMailbox "Search Mailbox" -TargetFolder "Search Folder" -searchquery (Joe Smith OR John Smith OR TD-17-15) OR (cat AND dog) OR (cat AND pig) OR (cat AND horse) OR (cat AND snake) OR (cat AND flower) OR (stone AND heat) OR (stone AND cold) OR (blue AND red AND pink) OR (purple AND green AND pink) AND (received>="11/1/2010" OR sent:>="11/01/2010) -LogLevel Full -LogOnly
Could someone help with the proper formatting to do this if it's possible? Nothing I've tried will work. Thanks for any help.
The simple answer is 'yes' and your question could be considered a duplicate of this discussion.
Search-Mailbox SearchQuery - trouble with AND and OR
With this answer
SearchQuery "Attachment:p* AND From:$email AND To:reception#contoso.com AND Received<``"04/02/2018``" AND (Subject:GfC* OR Subject:G4C* OR Subject:c4g* OR Subject:GfC OR Subject:G4C OR Subject:c4g)"
Other examples of your use case are in blogs all over the web.
Just search for your use case --
'search-mailbox using or'
Example(s)
Using Search-Mailbox to look for items with a specific date
Get-Mailbox –Database VIP –ResultSize Unlimited | Search-Mailbox -TargetMailbox AdminSearchMailbox -TargetFolder "Search Results" -SearchQuery {Subject:"Interesting" AND From:"Ben Andrews" AND Sent:"10/13/2014"} -LogOnly -LogLevel Full –SearchDumpster
Also, always edit your original question, to make things easier to follow, vs putting code in the comment section.
Related
Trying to use PowerShell to search O365 mailbox to get all messages where subject line doesn't contain specific string, specifically a square bracket [
The command below works fine in principal to find all messages where subject contains a specific word, but can't get it to work to find all messages where subject DOES NOT contain a specific word (or in this case character [)
Search-Mailbox -Identity "fred#email.com" -SearchQuery 'Subject:"*" -[' -EstimateResultOnly
The eventual aim is to scan a mailbox to remove all content other than messages which contain square brackets in the subject line, so will use -DeleteContent switch or similar, for now just using -EstimateResultOnly or -LogOnly -LogLevel Full and -TargetFolder -TargetMailbox to see a list of what it finds
What am I missing - all comments appreciated.
Thanks
Use a -filter with -notlike should work.
I'm attempting to prompt user input to search for specific emails using a piped command like this:
get-mailbox -ResultSize unlimited | search-mailbox -searchquery 'subject:"*$Subject*"' -LogOnly -Loglevel Full -TargetMailbox "$Self" -TargetFolder "$Folder"}
When I perform a search like this, the subject is never changed to what $Subject is even if I manually input it. I'm using a variable set like $Subject = Read-Host "Type in the email subject"
Essentially what I'm trying to accomplish is have a technician choose what fields to search for an email with. Sender/Date/To/From etc. By choosing an option, it will perform the code in that section. The most important field is the Subject. But the subject never populates to what the variable is.
If I type the whole search string without variables it works perfectly.
What am I missing? Thanks!
To expand the $Subject variable, construct the query first or inside parantheses:
$Subject="Good Morning"
$SearchQuery = 'Subject:'+'"*'+$subject+'*"'
Get-Mailbox -ResultSize unlimited | Search-Mailbox -SearchQuery $SearchQuery [...]
I have a requirement to search mailboxes for an email based on subject line and report if the email is in the Inbox or another folder. The below code works well for individual users.
Search-Mailbox -Identity "test#example.com" -SearchQuery ‘Subject:”Suspect email alert”‘ -TargetMailbox “admin” -TargetFolder “inbox”-LogOnly -LogLevel Full
The report received states if the email is in that particular mailbox and the location. This is great for one user, though I need to do this for over 500 users.
I have a csv file with a list of email addresses I need to check for this particular email and it's location. So I have imported the csv file to a variable. Then put the command in a foreach loop, though cannot get this working correctly.
Correction: updated to txt file a used get-content
$users = Get-Content -Path userslist.txt
foreach ($user in $users) {
Search-Mailbox $user -SearchQuery ‘Subject:”Suspect email alert”‘ -TargetMailbox “admin” -TargetFolder “inbox”-LogOnly -LogLevel Full }
How do I run through the list of users, so I can get one report rather than a report for each user individually. Any ideas would be great.
Issue was with the csv file formatting. imported text file and loop running fine. Would be good to get the results into one Search results file, rather than one for each loop.
Okay, so this seems like a silly question, but I can't seem to find anything about it. I've checked in the AQS and haven't seen anything about it yet either. So I'm trying to conduct a search on the subject line of all mailboxes in my organization with a query like this:
foreach ($db in $mdblist) {Get-Mailbox -Database $db -ResultSize Unlimited |
Search-Mailbox -SearchQuery 'subject:"Monthly Expences Report" AND attachment:"Report_######.doc"' -LogOnly -LogLevel FULL -TargetMailbox joseph.c.larrew -TargetFolder Searches\1003333 |
Both the subject parameter and attachment parameter are literal strings and I did mean to spell "expences" that way.
I can do a search for just the subject and a separate search for the attachment and both give positive results, but when I "AND" them, no results. I've done a search against a specific mailbox that I know should come up with a positive and still no dice. Any thoughts?
About 3 or 4 times a week a clever spammer gets a message through my Sonicwall ESA and I need to scrub it from the exchange server. I'm network admin at a school, and students are suckers for that stuff. I run the following command as a global admin on my exchange server power shell:
Get-Mailbox -ResultSize Unlimited | Search-Mailbox -SearchQuery 'Subject:"Re-Please Update Your Password"' -DeleteContent
The odd thing is, about 99 out of 100 times it works. Within a few minutes the message with the aforementioned email disappears from my inbox and I go about my day. Once in a while, like today with the exact command listed above, I get a stubborn email that just won't go. At first I thought it was choking on the dash, so I changed the command to:
Get-Mailbox -ResultSize Unlimited | Search-Mailbox -SearchQuery 'Subject:"Please Update Your Password"' -DeleteContent
Still no joy. I'm not getting any errors, the command appears to run like normal. Anyone else run into this before? Any pointers?
Thanks.
-Bishop
I've had similar issues, tho they were more obvious (multiple [8-12] spaces). So instead of running the command over and over increasing the spaces in the query or configuring an expression for every case, I just grabbed the subjectline itself.
find the message in your mailbox, pull the subject into a variable, use that as the Searchquery.
-FS