Search-Mailbox -SearchQuery 10000 results override

Question

_{Monday, July 10, 2017 8:49 AM}

Hi,

I am testing upgrade path to Exchange 2016 from Exchange 2010, and I am facing a show-stopper. For my purposes, one of most important features of Exchange 2010 is the ability to delete messages from certain time period from single mailbox, eg:

Search-Mailbox -Identity <alias> -SearchQuery '(kind:email) and (received<01/01/2017)' -DeleteContent

However, Exchange 2016 returns only 10000 emails per mailbox if a search query is specified, which renders this command completely useless for my purposes.

Is there a way to override 10000 results limit? Or is there another PowerShell one-liner which can give me the same result of deleting all the messages older than certain date from single mailbox, no matter how many messages it contains?

Thank you in advance,

All replies (13)

_{Monday, July 10, 2017 9:49 AM}

This beaviour changed and now you have to user new-mailboxsearch for getting larger search results.

https://technet.microsoft.com/en-us/library/dd298064(v=exchg.160).aspx

Jayakumar K

_{Monday, July 10, 2017 10:53 AM}

Thank you for your reply.

Could you please give me an example how to delete messages with New-MailboxSearch? I'm re-reading Exchange 2016's New-MailboxSearch page, but I can't seem to find the parameter. Perhaps because there isn't any?

Oh, and by the way I'd rephrase 'This behaviour changed' to 'Microsoft removed functionality which is of critical importance to the customer'. The famous Microsoft backward compatibility.

Any hints on how to delete unlimited number of messages from certain time period from single mailbox much appreciated.

_{Monday, July 10, 2017 12:04 PM}

First you need to search and later use that search name to delete the contents.Follow the below article.

https://technet.microsoft.com/en-us/library/mt210913(v=exchg.160).aspx

If the contents are less you can still use the search-mailbox option itself else you need to combine these 2 actions.

Jayakumar K

_{Monday, July 10, 2017 4:33 PM}

Use the -DeleteContent switch or a 3rd party product like DigiScope 

https://technet.microsoft.com/en-us/library/ff459253(v=exchg.150).aspx

Search, Recover, Export Mailboxes, Folders, Email, Contacts, Calendars, Tasks, etc. from Offline Exchange Databases (EDBs), On-Premise Exchange Servers and Office 365. Migrate/Recover direct from any offline EDB into any On-Premises Exchange Server, even cross version i.e. 2003 → 2007 → 2010 →2013 → 2016 → Office 365 with Lucid8's DigiScope

_{Tuesday, July 11, 2017 8:26 AM}

Is there a way to override 10000 results limit? Or is there another PowerShell one-liner which can give me the same result of deleting all the messages older than certain date from single mailbox, no matter how many messages it contains?

Hi Vasja,

No that I'm aware of, this seems to be by design.

If you want to delete the messages older than certain date from a single mailbox, use "search-mailbox" cmdlet within "-DeleteContent" parameter would be a best choice, if you are worried about the limit, run the command twice or more would be a workaround to evade the limit. For example, you can specify an earlier date to delete a batch of messages, then run the command within a later date again.

Best Regards,

Niko Cheng
TechNet Community Support

Please remember to mark the replies as answers.
If you have feedback for TechNet Subscriber Support, contact [email protected].

_{Tuesday, July 11, 2017 11:35 AM}

@Yayakumar: I am currently researching my options with Compliance Search, as you suggested. It seems it can be done, but admins' effort triples from one command (Search-Mailbox in Exchange 2010) to three commands (New-ComplianceSearchAction, Start-ComplianceSearch, Remove-ComplianceSearch). I see the benefits for new approach when dealing with all the mailboxes on the system (for example deleting of yesteryear's messages from all the mailboxes). However, dealing with single mailboxes with new approach is much more complicated.

@Troy: Thank you for information about DigiScope, but for money my company pays to Microsoft for Exchange I expect to have the ability to administer it included in price. I don't ask for a new feature - just the ability to do what I have been able to do in previous version.

@ Niko: Your suggested approach does not seem to work, due to the fact that newer messages get searched first. Therefore, if a mailbox contains more than 10000 messages, and I want to delete oldest ones, filter will never hit them.

What can I say? I had the good will to implement (and pay for) Exchange 2016, but it seems I'll wait for a few more years (Exchange 2010 will be supported until January of 2020 according to current information) to see if Microsoft gives me (back) the ability to easily administer my Exchange setup. A simple -nofilterlimit switch to Search-Mailbox, or registry key change would suffice. Maybe I'm even a little glad to have additional reasons to present to my management regarding benefits of switching to BSD/Postfix/Dovecot.

In the meantime, I'm watching this thread closely for tips on how to easily delete messages from certain time period from single mailbox which contains more than 10000 messages.

_{Tuesday, July 11, 2017 2:50 PM}

I completely understand your position, Exchange is a constantly evolving product and I am sure the limits are put in place for a reason, that said I can see how it could be very frustrating on your end :-(

Search, Recover, Export Mailboxes, Folders, Email, Contacts, Calendars, Tasks, etc. from Offline Exchange Databases (EDBs), On-Premise Exchange Servers and Office 365. Migrate/Recover direct from any offline EDB into any On-Premises Exchange Server, even cross version i.e. 2003 → 2007 → 2010 →2013 → 2016 → Office 365 with Lucid8's DigiScope

_{Wednesday, July 12, 2017 1:25 PM}

@Yayakumar: I am currently researching my options with Compliance Search, as you suggested. It seems it can be done, but admins' effort triples from one command (Search-Mailbox in Exchange 2010) to three commands (New-ComplianceSearchAction, Start-ComplianceSearch, Remove-ComplianceSearch). I see the benefits for new approach when dealing with all the mailboxes on the system (for example deleting of yesteryear's messages from all the mailboxes). However, dealing with single mailboxes with new approach is much more complicated.

@Troy: Thank you for information about DigiScope, but for money my company pays to Microsoft for Exchange I expect to have the ability to administer it included in price. I don't ask for a new feature - just the ability to do what I have been able to do in previous version.

@ Niko: Your suggested approach does not seem to work, due to the fact that newer messages get searched first. Therefore, if a mailbox contains more than 10000 messages, and I want to delete oldest ones, filter will never hit them.

What can I say? I had the good will to implement (and pay for) Exchange 2016, but it seems I'll wait for a few more years (Exchange 2010 will be supported until January of 2020 according to current information) to see if Microsoft gives me (back) the ability to easily administer my Exchange setup. A simple -nofilterlimit switch to Search-Mailbox, or registry key change would suffice. Maybe I'm even a little glad to have additional reasons to present to my management regarding benefits of switching to BSD/Postfix/Dovecot.

In the meantime, I'm watching this thread closely for tips on how to easily delete messages from certain time period from single mailbox which contains more than 10000 messages.

Yes..Agree,its administrative overhead.For single mailboxes you can still go with search-mailbox option.

Jayakumar K

_{Wednesday, July 12, 2017 3:34 PM | 1 vote}

I wrote a quick script that will loop the Search-Mailbox until it doesn't find any more instances of the message...you can prolly modify it for your needs.

It can be found here:

http://exchangeitup.blogspot.com/2017/01/exchange-search-mailbox-delete-more.html

My Blog: http://exchangeitup.blogspot.com My Twitter: http://twitter.com/ExchangeITup

_{Wednesday, July 26, 2017 3:58 AM}

Hi KappaStar,

Just checking in to see if above information was helpful. If you have any questions or needed further help on this issue, please feel free to post back. If the issue has been resolved, please mark the helpful replies as answers, this will make answer searching in the forum easier and be beneficial to other community members as well.

Thanks for your understanding.

Best Regards,

Niko Cheng
TechNet Community Support

Please remember to mark the replies as answers.
If you have feedback for TechNet Subscriber Support, contact [email protected].

_{Monday, February 19, 2018 9:32 AM | 1 vote}

None of above information was helpful, although I am grateful for any feedback.

Here's summary, hopefully it will help someone:

• In Exchange 2010, admin was able to delete last year's worth of emails from users' mailboxes with an one-liner:

Search-Mailbox -Identity <alias> -SearchQuery '(kind:email) and (received<01/01/2018)' -DeleteContent

• In Exchange 2016, Search-Mailbox command was modified to return only 10000 results if -SearchQuery switch is present, rendering the above command useless for the purpose of deletion of old messages, as most mailboxes have more than 10000 messages a year - older than 10000th message never even hits SearchQuery
• Supposed replacement, New-ComplianceSearch + Start-ComplianceSearch + New-ComplianceSearchAction can't be used because "A maximum of 10 items per mailbox can be removed at once"

Conclusion: Exchange 2016 does not have native functionality to delete large number of messages from mailboxes with simple onl-liner command, while Exchange 2010 had this functionality. Exchange 2016 regressed in mailbox maintainability when compared to Exchange 2010.

_{Tuesday, March 6, 2018 9:40 PM}

Hi Stacey! This is great! I do have a question, however. I have a similar script that doesn't use the -erroraction silentlycontinue in it because I wanted to see it. So when it runs each iteration, I get an error stating it did not complete because it timed out. Then is shows results with itemcount 0. It that because it is not working or because the results were deleted? I am seeing the total items count decrement very slowly, not by 10000. It has taken hours to delete 13000 items. Is that what I should expect?

Thanks for the script! 

_{Tuesday, July 16, 2019 2:37 PM}

It's good although very slow.. iterations sometimes go from 10 minutes to literally hours for each 10.000 emails.

Microsoft, this is a joke..