Exchange 2007 - Need to find all emails sent to and from particular domain

Question

I need to find all emails sent to and from a particular domain (abc.org). Does anyone know if I can use wildcard in the following query?

get-mailbox -OrganizationalUnit EMPL | export-mailbox -SubjectKeywords "Keywords"
-ContentKeywords "Keywords" -AllContentKeywords "Keywords" -SenderKeywords "*@abc.org"
-RecipientKeywords "*@abc.org" -StartDate 03/01/11 -EndDate 05/05/2011 
-ExcludeFolders "\Contacts", "\Calendar", "\Notes", "\Tasks", "\Junk E-Mail", 
"RSS Feeds" -TargetFolder xyz -TargetMailbox xyz

I'm not getting the results I anticipated and cannot find authoritative documentation on it.

Thanks in advance for any help on this.

Does FOIA refer to the freedom of information act? If so, is it really necessary in the question title? (hint: you might get more views if you genericise(word?!) the title) — Ben Pilbrow, May 13 '11 at 18:06
Do you get any results if you use a particular email address instead of the wildcard? — Kara Marfia, May 13 '11 at 20:33
Kara - I didn't have any email addresses to work with, only domains. — user81308, May 16 '11 at 23:31

score 2 · Accepted Answer · answered May 13 '11 at 16:23

What do you mean by "not getting the results I anticipated"? Are you getting 0 messages, a few messages, every single message?

I cannot find authoritative documentation either that says "yes" or "no" to wildcards. The Technet documentation specifically notes that wildcards are allowed for other parameters, but states nothing about wildcards for senderkeywords and recipientkeywords. (Export-Mailbox for 2007)

I do note, however, you have defined both sender and recipient keywords in the same command. Perhaps you could run this twice, once looking for all inbound mail and once looking for all outbound? I don't think that export-mailbox will know that you're looking for the two as 'either/or' instead of 'and'.

Thanks for the suggestion to run it twice. That will be my next step. As far as "anticipated" results, I find it very, very hard to believe that not a single person communicated with the organization in question :) — user81308, May 13 '11 at 17:19

Exchange 2007 - Need to find all emails sent to and from particular domain

1 Answers1