Powershell – KQL Query to specify date range for Mailbox search

exchange-2010powershell

I'm trying to verify some phone numbers using our exchange server with the following query to send the results to my inbox:

Get-Mailbox | Search-Mailbox -SearchQuery “Body: '*XXX-XXX-XXXX*' OR '*XXX-XXX-XXXX*'" -TargetMailbox myusermailbox -TargetFolder verification

How do I specify a date range to search? As the phone numbers usually appear in people's signatures, and I don't want to return every email they've ever sent, just recent ones.

I tried using the -StartDate and -EndDate but it failed with the error message:

A positional parameter cannot be found that accepts argument '05-19-2014'.
    + CategoryInfo          : InvalidArgument: (:) [Search-Mailbox], ParameterBindingException
    + FullyQualifiedErrorId : PositionalParameterNotFound,Search-Mailbox

Invoke-Command : Cannot write input as there are no more running pipelines
At C:\Users\administrator.UCPSAR\AppData\Roaming\Microsoft\Exchange\RemotePowerShell\exch2010.ucpsar.org\exch2010.ucpsa
r.org.psm1:43454 char:29
+             $scriptCmd = { & <<<<  $script:InvokeCommand `
    + CategoryInfo          : InvalidOperation: (:) [Invoke-Command], PSInvalidOperationException
    + FullyQualifiedErrorId : NoMoreInputWrite,Microsoft.PowerShell.Commands.InvokeCommandCommand

I'm thinking maybe the parameters need to be specified as part of a KQL query but I'm uncertain of where to start.

Best Answer

Give this a shot in your SearchQuery:

-SearchQuery "Sent: > $('01/01/2012 00:00:00') AND Received: < $('01/31/2012 23:59:59') AND Body: ('*XXX-XXX-XXXX*' OR '*XXX-XXX-XXXX*')"

I don't have access to an environment to test this at the moment. This is modified from http://windowsitpro.com/exchange-server-2010/search-destroy-email-content-exchange-2010.

Also see http://msdn.microsoft.com/en-us/library/aa965711%28v=vs.85%29.aspx for more information on forming AQS queries.

Related Topic