Share via


use Search-Mailbox to find messages with attachments

Question

Saturday, February 25, 2012 2:46 PM

Hi,

I am trying to use search-mailbox to find email messages with attachments, but cannot do this. I can use something like attachment:xls to find excel files, but attachment:* does not work. It should be simple but I cannot figure it out.

All replies (8)

Saturday, February 25, 2012 3:17 PM

Seen the examples here - http://technet.microsoft.com/en-us/library/bb232132.aspx

Sukh


Saturday, February 25, 2012 3:27 PM

Seen the examples here - http://technet.microsoft.com/en-us/library/bb232132.aspx

Sukh

yes, but it fails:

 

Identity                 : 550574cb-b846-4cfa-81f3-c20779adf323
Name                     : srch-hasattach4
CreatedBy                :
SourceMailboxes          : {}
TargetMailbox            :
SearchQuery              : hasattachments:true
Language                 : en-US
Senders                  : {}
Recipients               : {}
StartDate                : 2/25/2012 3:30:00 AM
EndDate                  : 2/25/2012 3:30:59 AM
MessageTypes             : {email}
SearchDumpster           : True
IncludeUnsearchableItems : True
DoNotIncludeArchive      : False
EstimateOnly             : False
ExcludeDuplicateMessages : True
Resume                   : False
LogLevel                 : Full
StatusMailRecipients     : {}
Status                   : Failed
LastRunBy                : -
LastStartTime            : 2/25/2012 6:51:50 PM
LastEndTime              : 2/25/2012 6:51:50 PM
NumberMailboxesToSearch  : 1
PercentComplete          : 0
ResultNumber             : 0
ResultNumberEstimate     : 0
ResultSize               : 0 B (0 bytes)
ResultSizeEstimate       : 0 B (0 bytes)
ResultSizeCopied         : 0 B (0 bytes)
ResultsLink              :
Errors                   : {The property keyword isn't supported.}
KeywordHits              : {}


Saturday, February 25, 2012 3:49 PM

The property keyword isn't supported

I dont think that what you're trying to do is supported on Exchange.

Sukh


Saturday, February 25, 2012 3:52 PM

it does not make sense,

you can search for a specific atttachment, but cannot filter mails with attachments


Thursday, May 24, 2012 2:09 PM

This works but is a little tricky with the quotes, working example:

Get-Mailbox -ResultSize Unlimited | Search-Mailbox -SearchQuery 'Attachment:"Blah Blah.pdf"' -TargetMailbox usermbx -TargetFolder BLAHPDFAttachments -LogOnly -LogLevel Full

Notice the quotes around attachment and the name 


Tuesday, April 30, 2013 4:45 PM | 2 votes

In addition to the rest... it looks like "attachment:'*'" works to find "any" attachment in the search query part, or you can put in a specific document name.  Not sure how to "negate" it though (find something without attachments).

BYoung, Sr. Server Analyst


Monday, June 30, 2014 2:52 PM

This doesn't seem to work for me....I have a mailbox with only 5 attachment throughout the entire mailbox.  This attempt with the * to only find messages with any attachment produces 3000 results.  I have looked at the log and it contains messages that do NOT have attachments.  I have tried to resolve this issue a million different ways.  Even when i do -attachment:"a*" , I get more results than expected.   This is quite puzzling!!


Wednesday, November 6, 2019 3:07 PM

Hi,

I have recently encountered this too. Found out that there is a bug in Exchange when you use attachment search. Bug was fixed in exchange 2013 CU12, and now you need to use "AttachnmentNames" property:

Search-Mailbox -SearchQuery AttachmentNames:pdf

https://support.microsoft.com/en-us/help/3134894/search-mailbox-cmdlet-with-attachment-keyword-lists-all-items-that-con

Still, it would be also very helpfull if there was an option to search mail that has attachment, regardless of name or extension. Somethin like "HasAttachment:TRUE" or something like that for on premises Exchamge.

Exchange Online seem to have this:

https://docs.microsoft.com/en-us/microsoft-365/compliance/keyword-queries-and-search-conditions

"HasAttachment Indicates whether a message has an attachment. Use the values true or false."