Glen's Exchange and Office 365 Dev Blog

eDiscovery in Exchange 2013 and above has a multitude of uses when it comes to both data discovery and also reporting. One thing you can do with eDiscovery is run a single Query across multiple mailboxes using one request. A couple of month ago I posted this eDiscovery Powershell module on GitHub . This module has a number of cmdlets that does single mailbox queries using eDiscovery so I've created a new cmdlet Search-MultiMailboxesItemStats  for doing Multi Mailbox queries. This allows you to pass in an array of mailboxes you want processed and it will return statistics about how many Items and the Size of those items in bytes based on that query. For example to Query the number of Email received in the last month across a number of mailboxes use Search-MultiMailboxesItemStats -Mailboxes @( 'mailbox@domain.com','mailbox2@domain.com' )  -QueryString ('Received>' + (Get-Date).AddDays(-31).ToString("yyyy-MM-dd")) And it will output something l...

eDiscovery is one of the more useful features introduced in Exchange 2013, and offers a quick and powerful way of Searching and reporting on Items in a Mailbox or across multiple mailboxes on an Exchange Server or in Exchange Online. In this post I wanted to rollup a few eDiscovery scripts I posted in the past to a more user friendly and expandable PowerShell module. eDiscovery uses KQL (Keyword Query Language) to search indexed properties which are listed on https://technet.microsoft.com/en-us/library/dn774955(v=exchg.150).aspx  . For doing quick reporting with eDiscovery you can tell Exchange to only return the number (and size) of the items that match your KQL query. Otherwise Exchange will return preview items (200 at time) which means the query can take some time to complete if your enumerating though a large result set. I've tried to take a very modular approach with the code in this module to make it easier to extend Permissions - The eDiscovery parts of...

One of the features of eDiscovery in Exchange 2013 and greater is the ability to do a search of Mailbox and just return the statistics on particular Items (or searches). This allows you to do a really quick search without the need to process any of the ResultSet of the Search.  To limit the Items types returned by an eDiscovery query you can use the kind Keyword property in a KQL query. The feature set of which has recently been updated https://technet.microsoft.com/en-us/library/dn508399(v=exchg.150).aspx  to now allow you to include Lync (or IM) items. So one little cool thing you can do with this using a multiple OR logic query with eDiscovery is get a quick list of the number of exchange Items by type in a Mailbox eg the KQL for this would look like "kind:email OR kind:meetings OR kind:contacts OR kind:tasks OR kind:notes OR kind:IM OR kind:rssfeeds OR kind:voicemail" and this would produce a report that looks like I've put together a sample of a script to d...

With the average size of Mailbox\Archives getting larger by the day eDiscovery on Exchange 2013 is useful for a broad array of tasks. eDiscovery makes use of the KQL (Keyword Query Language https://msdn.microsoft.com/EN-US/library/office/ee558911(v=office.15).aspx  ) which allows you to query for both free text and Queryable properties that have been indexed by the Exchange store and it also allows the use of some more complex operators such as proximity and Synonyms. Let's look at a specific user case for eDiscover, the Lync client on 2013 will automatically add contacts to your Exchange Mailbox in the "Lync Contacts" folder and flag the body of the contact with something like 2/02/2015 This contact was added from Microsoft Lync 2013 (15.0.4675.1000) (if you want to bind directly to the Lync Contacts folder in 2013 you should be able to use the QuickContacts WellKnownFolder Enum eg $folderid= new-object Microsoft.Exchange.WebServices.Data.Fold...

I've posted before on Exchange 2010 about how you can use AQS to produce a mailbox Item Age and Size reports. This same method can be used and enhanced on 2013 using eDiscovery to produce a growth report. Eg something like this that shows the mailbox growth for each folder (that has grown) based on the size of the Items in the folder for that month and an ASCII graph to show the growth vs the FolderSize So to do this the follwing script uses eDiscovery on 2013 or Exchange Online to make a query of all the items in the primary mailbox over the period of 12 months using the following KQL query received:2013-01-01..2014-01-01 Which queries for items that where received between these two dates, in the script I have variables to calculate this to give the exact 12 month period eg $KQL = "received:" + $StartDate.ToString("yyyy-MM-dd") + ".." + $EndDate.ToString("yyyy-MM-dd"); The rest of the script is another variant of my eDiscovery t...