KQL Query to specify date range for Mailbox search?

exchange-2010 powershell

5,049

Give this a shot in your SearchQuery:

-SearchQuery "Sent: > $('01/01/2012 00:00:00') AND Received: < $('01/31/2012 23:59:59') AND Body: ('*XXX-XXX-XXXX*' OR '*XXX-XXX-XXXX*')"

I don't have access to an environment to test this at the moment. This is modified from http://windowsitpro.com/exchange-server-2010/search-destroy-email-content-exchange-2010.

Also see http://msdn.microsoft.com/en-us/library/aa965711%28v=vs.85%29.aspx for more information on forming AQS queries.

5,049

leeand00

Projects jobdb - Creator of Open Source Job Search Document Creator/Tracker http://i9.photobucket.com/albums/a58/Maskkkk/c64nMe.jpg Received my first computer (see above) at the age of 3, wrote my first program at the age of 7. Been hooked on programming ever since.

Updated on September 18, 2022

Comments

leeand00 over 1 year

I'm trying to verify some phone numbers using our exchange server with the following query to send the results to my inbox:

Get-Mailbox | Search-Mailbox -SearchQuery “Body: '*XXX-XXX-XXXX*' OR '*XXX-XXX-XXXX*'" -TargetMailbox myusermailbox -TargetFolder verification

How do I specify a date range to search? As the phone numbers usually appear in people's signatures, and I don't want to return every email they've ever sent, just recent ones.

I tried using the -StartDate and -EndDate but it failed with the error message:

A positional parameter cannot be found that accepts argument '05-19-2014'.
    + CategoryInfo          : InvalidArgument: (:) [Search-Mailbox], ParameterBindingException
    + FullyQualifiedErrorId : PositionalParameterNotFound,Search-Mailbox

Invoke-Command : Cannot write input as there are no more running pipelines
At C:\Users\administrator.UCPSAR\AppData\Roaming\Microsoft\Exchange\RemotePowerShell\exch2010.ucpsar.org\exch2010.ucpsa
r.org.psm1:43454 char:29
+             $scriptCmd = { & <<<<  $script:InvokeCommand `
    + CategoryInfo          : InvalidOperation: (:) [Invoke-Command], PSInvalidOperationException
    + FullyQualifiedErrorId : NoMoreInputWrite,Microsoft.PowerShell.Commands.InvokeCommandCommand

I'm thinking maybe the parameters need to be specified as part of a KQL query but I'm uncertain of where to start.

joeqwerty almost 10 years

Try using -StartDate and -EndDate in this format -StartDate "5/19/2014"
leeand00 almost 10 years

I tried that, still got an error.
leeand00 almost 10 years

Wait is Body:'*stuff*' StartDate:'05/19/2014' EndDate:'05/20/2014' a valid query string?

leeand00 almost 10 years

Hmm I wonder what the difference is between queryable, retrievable, and searchable? (technet.microsoft.com/en-us/library/…)
Phil Erb almost 10 years

See the notes at the bottom of that TechNet article.