Discovery in the Dark of Night (Searching Exchange 2010 Mailboxes)

Dr. John H. Watson, if not as highly deductive as his friend Sherlock Holmes, was certainly diligent enough to make some significant discoveries. Imagine if your messaging platform could be such a trusty partner and find messages matching certain patterns in the dark of night and save the results for you when you needed them.

Exchange Server 2010 supports searching any number of mailboxes, from one to the total number of mailboxes in the Exchange organization, for particular content patterns. This type of multi-mailbox search, called a Discovery Search, can do its work while you are sleeping, and the results are stored in a special type of mailbox called a Discovery Search Mailbox. Therefore, prior to issuing a discovery search request, you should first create a discovery search mailbox to hold the search results.

When you install Exchange Server 2010, the setup program creates one discovery mailbox for your convenience. Prior to performing a discovery search, you can choose to use this or any other discovery mailbox you have created earlier. Or you could use the Exchange Management Shell (EMS) to create a new discovery mailbox. To create a new discovery mailbox, simply run the New-Mailbox cmdlet in the shell with the -Discovery parameter. The discovery mailbox must be stored on an Exchange Server 2010 server hosting the Mailbox role.

Part of the idea behind discovery mailboxes is that you can execute multiple searches and have the results saved in different mailboxes. Extending this concept beyond one administrator or other person delegated the discovery search capability, multiple people can perform their own discovery searches to meet their own goals. Each person can have their own collection of one or more discovery mailboxes that they use to store their results independent of the others.

Another aspect of discovery mailboxes which is important is that, like ordinary user, room, and equipment mailboxes, each discovery mailbox is hosted by a particular mailbox database on your Exchange servers. Each discovery mailbox also has its own quota, which defaults to 50 GB of search results. In addition, each discovery mailbox has permissions which can be assigned to it which govern who can look at the search results, among other allowances.

Discovery search requests can be initiated with either the EMS cmdlet New-MailboxSearch or using the Outlook Web App (OWA) hosted Exchange Control Panel (ECP). Once a request has been created, it can be paused or resumed using the EMS Stop-MailboxSearch or Start-MailboxSearch cmdlets, or via the web-based ECP. The search criteria or source mailboxes could also be modified using the Set-MailboxSearch cmdlet or ECP rather than needing to delete the old request using a Remove operation then a New (create) operation again.

The requester may view the results of the search as soon as they are complete, or could wait to view them until a later date. Like other mailboxes hosted by Exchange Server 2010, the discovery mailboxes could be placed on litigation (legal) hold for retention.  Note that only mailboxes which are hosted on Exchange Server 2010 servers with the mailbox role are searched. Exchange Server 2007 mailboxes, Exchange Server 2003 mailboxes, and personal folder storage (PST) files are not searched using the Exchange Server 2010 multi-mailbox search feature. Again, the discovery mailboxes which store the search results must also be hosted by Exchange Server 2010.

Discovery (multi-mailbox) searches and the discovery mailboxes which support them are a great capability of Exchange Server 2010. How would you use this feature?


Related Course:

Configuring, Managing, and Troubleshooting Microsoft Exchange Server 2010 (M10135)

In this article

Join the Conversation