Cleaning Up Unwanted Content

We were not quite sure where to put this section of the book since it did not fit well into any particular chapter. So here is where you find information on how to export data out of a mailbox. In the past, we used tools such as ExMerge to remove mail from a mailbox if it was no longer necessary (such as old mail that's archived) or if we had to remove a message that contained avirus.

Exchange 2007 introduces a new Exchange Management Shell cmdlet called Export-Mailbox that you can use to remove content from a mailbox or a whole group of mailboxes. Export-Mailbox is a lot more efficient and flexible than ExMerge is too.

The Export-Mailbox wizard allows you to search through one or more mailboxes, and when message content is found, it is copied to an alternate mailbox. Optionally, you can specify a parameter that allows you to delete the message from the original location. You can specify a number of different criteria to narrow the scope of the messages for which you are searching. Table 21.10 lists the Export-Mailbox parameters along with a description and an example of using each one.

Table 21.10: Search Parameters That Can Be Used with the Export-Mailbox Cmdlet
Open table as spreadsheet

Parameter	Description and Example
AllContentKeywords	When all AllContentKeywords is used, the command will find the keywords you specify in the message subject, body, and attachments. This parameter should not be used in conjunction with the ContentKeywords and SubjectKeywords parameters. Here is an example of this parameter's formatting: -AllContentKeywords "ILOVEYOU"
AttachmentFilenames	Locates messages with a specific filename or when using wildcards. Here are two examples: -AttachmentFilenames "*.txt" and -AttachmentFilenames "iloveyou.vbs"
ContentKeywords	Content keywords allow you search for content in the message body and attachment content. If you use ContentKeywords and SubjectKeywords in the same command, the content must match both. Here is an example: -ContentKeywords "secret formula"
EndDate	EndDate specifies the last date that will be used when copying or moving messages out of a mailbox. If a message is dated after the end date but it meets the criteria, it will not be copied or moved. You can optionally use a time with the date if you want to search only to a certain point during a day. Here are some examples: -EndDate"02/01/2007" and -EndDate "02/02/2007 11:30:00"
ExcludeFolders	If you have specific folders that you do not want to include in the search, you can use the ExcludeFolders parameter. Here is an example where we can exclude the Sent Items folder: -ExcludeFolders "\Sent Items"
IncludeFolders	If you have only specific folders that you want to include in your search, you can use the IncludeFolders parameter. For example, if you want to search in only the Inbox folder, here is an example: -IncludeFolders "\Inbox"
StartDate	StartDate allows you to specify a starting date for your search. When it's used in conjunction with the EndDate parameter, you can narrow the scope of time you are using to search for messages. You can optionally use a time with the date if you want to search only to a certain point during a day. Here are some examples: -StartDate "01/31/2007" and -StartDate"1/31/2007 11:30:00"
SubjectKeywords	Subject keywords are words found in the subject of a message. Here is an example: -SubjectKeywords "I quit"

When using the Export-Mailbox cmdlet, you must specify a target mailbox and a target folder to which you want to copy or move the messages. The -TargetMailbox parameter is used to specify the name of an existing mailbox; the mailbox must exist. The -TargetFolder parameter specifies the name of a folder in the root of the target mailbox. If this folder does not exist, it will be created.

Note 

Currently, Export-Mailbox provides no way to export content to a PST file; this is supposed to be a feature in Exchange 2007 Service Pack 1.

Mail is copied (or moved) to the target folder in the specified target mailbox. A folder structure is created under the specified target folder that includes the recovered data, the mailbox name, and the date of the recovery. An example of this is shown in Figure 21.25. One thing that you may find annoying is that all folders from the source mailbox are created even if there are no messages that meet the search criteria in a particular folder.

Figure 21.25: Example of the folder structure created by the Export-Mailbox cmdlet.

The Export-Mailbox cmdlet takes as input the identity of the mailbox to be searched; this can be in the form of the Exchange alias, the SMTP address, or the display name of the mailbox. Export-Mailbox will also accept as input mail-enabled objects piped from cmdlets such as Get-Mailbox and Get-DistributionGroupMember. Let's start out with a really simple example and look at the output. In this example, we want to export (copy) everything in a mailbox called supatana over the date range 01/01/2006 through 12/31/2006. The target mailbox is called MergeMailbox and the target folder is Jan2007Archive. Here is the cmdlet that will perform this operation:

 Export-Mailbox supatana -TargetMailbox MergeMailbox -TargetFolder Jan2007Archive -StartDate "01/01/2006" -EndDate "12/31/06" 

When you kick off the command, you will see a progress bar on the top of the management shell window.

The actual text output of this operation is as follows:

 C:\>Export-Mailbox supatana -TargetMailbox MergeMailbox -TargetFolder Jan2007Archive Confirm Are you sure you want to perform this action? Exporting mailbox content from the mailbox 'Matt Suriya' into the mailbox for 'MergeMailbox ([e-mail])' inside folder '\Jan2007Archive\Recovered Data - Matt Suriya - 1/1/2007 5:40:33 PM'.  This operation may take a long time to complete. [Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "Y"):y Identity                         : volcanosurfboards.com/Somorita Surfboards/ Matt Suriya DistinguishedName                : CN=Matt Suriya,OU=Somorita Surfboards, DC=volcanosurfboards,DC=com DisplayName                      : Matt Suriya Alias                            : supatana LegacyExchangeDN                 : /o=VOLCANO SURFBOARDS/ou=FIRST ADMINISTRATIVE GROUP/cn=RECIPIENTS/cn=SSUPATANASAKUL PrimarySmtpAddress               : [e-mail] SourceServer                     : HNLEX03.volcanosurfboards.com SourceDatabase                   : HNLEX03\First Storage Group\Mailbox Database SourceGlobalCatalog              : HNLDC01 SourceDomainController           : TargetGlobalCatalog              : HNLDC01 TargetDomainController           : TargetMailbox                    : volcanosurfboards.com/Users/MergeMailbox TargetServer                     : HNLEX03.volcanosurfboards.com TargetDatabase                   : HNLEX03\First Storage Group\Mailbox Database MailboxSize                      : 198655KB IsResourceMailbox                : False SIDUsedInMatch                   : SMTPProxies                      : SourceManager                    : SourceDirectReports              : SourcePublicDelegates            : SourcePublicDelegatesBL          : SourceAltRecipient               : SourceAltRecipientBL             : SourceDeliverAndRedirect         : MatchedTargetNTAccountDN         : IsMatchedNTAccountMailboxEnabled : MatchedContactsDNList            : TargetNTAccountDNToCreate        : TargetManager                    : TargetDirectReports              : TargetPublicDelegates            : TargetPublicDelegatesBL          : TargetAltRecipient               : TargetAltRecipientBL             : TargetDeliverAndRedirect         : Options                          : Default SourceForestCredential           : TargetForestCredential           : TargetFolder                     : \Jan2007Archive\Recovered Data - Matt Suriya - 1/1/2007 5:40:33 PM RsgMailboxGuid                   : RsgMailboxLegacyExchangeDN       : RsgMailboxDisplayName            : RsgDatabaseGuid                  : MoveType                         : Export MoveStage                        : Completed StartTime                        : 1/1/2007 5:40:36 PM EndTime                          : 1/1/2007 5:48:28 PM StatusCode                       : 0 StatusMessage                    : This mailbox has been exported to the target user mailbox. 

The report says that the mailbox was "exported," but that is actually a little misleading. It would be better to say that the mailbox was "copied" since the command did not delete any of the original content from the mailbox. To remove the content after it was copied, we could have used the -DeleteContent parameter in the command.

You may also wonder about all of the properties that don't seem to have values in this output. The Export-Mailbox cmdlet can also be used to move mailboxes from other Exchange organizations and into Exchange 2007, so many of these options are used with migrations from other organizations.

Warning 

Be careful when using a broad search and copy category. You could easily fill up a transaction log or database disk if you selected all of the mailboxes in your organization!

Let'slookatamoreusefulexample.Whatifauserhadsentamessagewiththesubject Executive Compensation to everyone in the Viper Pilots group? We can use a combination of two cmdlets to completely remove any message with that subject:

 Get-DistributionGroupMember "Viper Pilots" | Export-Mailbox -TargetMailbox MergeMailbox -TargetFolder ExecCompMessage -SubjectKeyWords "Executive Compensation" -DeleteContent