Mailbox Search in Exchange 2007 and Outlook 2007

Michael B. Smith, author of Monitoring Exchange Server 2007 with System Center Operations Manager (Sybex; March 2009)

There are many reasons why you may want to search through mailboxes that are present in your Exchange database. Most of those reasons tend to cluster around a single major area: litigation (or fear of same). That is, you (or your company) are involved in a lawsuit and need to mine your Exchange mailboxes as if they were a database; or your company is afraid that an action of one or more employees may lead to a lawsuit and need to find proof, one way or the other.

In Exchange Server 2003, search was a very expensive process in terms of server resources. Generating a full-text index to search against could utilize very large amount of processor time and disk resources. Therefore, it was turned off by default and had to be explicitly enabled.

In Exchange Server 2007, the search engine was completely rearchitected and reimplemented. Now, the indexing engine consumes relatively little processor or I/O resource, and it is enabled by default. The question is: does it help you?

If your users are using Outlook 2007 in online mode, using Outlook Web Access, or using a device that supports Exchange ActiveSync, the answer is yes! When executing a search against a user’s mailbox, the server based search is used, and this can provide absolutely stellar performance.

If your users are using Outlook 2007 in cached mode (or any earlier version of Outlook), the answer is no. When executing a search against a user’s mailbox, the in-built capabilities of Outlook are used to search the mailbox. In Outlook 2007 service pack 2, this can be quite speedy and provide acceptable performance. Outlook 2007 service pack 1 wasn’t horrible (as long as you updated your workstation to Windows Search 4.0). However, earlier versions of Outlook had very poor search performance.

That led to the development of a number of desktop search engines; for example Google Desktop Search, LookOut (which was purchased by Microsoft), and Copernic Desktop Search. These tools (and many others) created a separate search capability for Outlook.

However, searching mailboxes one at a time is very slow and prone to error.

In releases of Exchange prior to Exchange 2007, Microsoft provided a tool named ExMerge that had the capability of searching through multiple mailboxes for (somewhat) arbitrary content. As of Exchange 2007, Microsoft deprecated ExMerge and replaced it with a PowerShell cmdlet named Export-Mailbox. Note that there is nothing which prevents ExMerge from running against an Exchange 2007 database, and many companies still use the tool. However, it isn’t supported.

Export-Mailbox (and its partner, Import-Mailbox) has had many updates during the various service packs and Update Releases of Exchange 2007. As of Service Pack 1 Update Release 5, it is a fairly usable tool. Prior to that, it had a number of, shall we say, idiosyncrasies.

A primary difference between ExMerge and Export-Mailbox is how they each handle the dumpster (that is, items which have been deleted from a mailbox and are held in “deleted item recovery” awaiting their final purge). Those differences rate an entire article all on their own; just be aware that they are different.

Both provide mechanisms for exporting single or multiple mailboxes, mailboxes which have specific content in their subject header or message body, deleting attachments which have a certain name, etc.

However, their searching capability is very weak. Other than searching on a Subject, the recipients (To, CC, and BCC headers), the sender (Sender and From headers), and the Date field; you have no additional capability for examining message meta-data. Both are very resource intensive and will scan the entire mailbox that you specify for any criteria (that is, the searches aren’t very smart).

For better search and discovery tools, you should investigate third party providers.

ExMerge has another major disadvantage - it can only export to ANSI PSTs, which are limited to about 2 GB in size. Export-Mailbox can use Unicode PSTs, for effectively unlimited PST sizes.

System Cleanup

An Outlook user had this question: "I have a folder called System Cleanup at the same level as my Inbox. It has an Inbox folder and a Sent Items folder. The inbox has several items that look like messages that should have been archived, but my archive folder is a PST file local to my machine. The System Cleanup folder appears to be on my company Outlook Server. Can I archive the messages in it and delete it? "

First off, archiving to a PST on your desktop is usually a bad idea when you use Exchange server. The administrator should be archiving mailboxes using a server-based archive solution, based on corporate retention policies.

The System Cleanup folder is a special folder created by Exchange for system cleanup when the administrator
set up and enabled a mailbox manager policy on Exchange server. The system cleanup process creates a copy of your mailbox's folder hierarchy under the System Cleanup root folder. Messages affected by Mailbox manager rules are moved to the appropriate subfolder of the System Cleanup folder, giving users a way to recover recently deleted items. A second policy may delete items in the System Cleanup after a period of time.

You could archive the messages in it but should not delete the folder. Exchange will recreate it the next time Mailbox manager runs.

If you'd like to learn more about System Cleanup, see http://technet.microsoft.com/en-us/library/aa998071.aspx.

Outlook 2007 SP2 Problems

We're seeing a few reports of problems with Outlook after installing SP2. Some are related to Windows Desktop Search reindexing the PST/OST and causing Outlook to be very slow. Once the indexing ends, Outlook's performance improves.

For other problems, try the usual troubleshooting methods: Restart Outlook in Safe mode, run Office Diagnostics, or make a new profile to narrow down the problem.

There is a bug with the Desktop alert that affects some users. The users report that when new mail arrives as Outlook first loads, the desktop alert won't work until Outlook is restarted. If no new mail arrives as Outlook is first loading, the alert works on later Send/Receives, at least for a few hours. Microsoft is aware of the problem.

Exchange Quick Tip: Add Additional SMTP Addresses

An administrator wanted to know how to add additional SMTP addresses to an Exchange 2003 mailbox: "A user wants to add another email address using his first name only but still receive mail using the original address. How do I set this up?"

Administrators can add additional SMTP addresses to an Exchange mailbox and the mailbox will receive all mail for the addresses. Sent mail will always use the default address. If you need to send from multiple addresses you'll need to use other methods to deliver the mail to one Inbox and give Send as rights to the other addresses.

To add additional SMTP address in Exchange 2003, locate the user account in Active Directory Users and Computers; in Exchange 2007, open the user account in Exchange System Console. Right click on it and choose Properties then select the Email Address tab. Click the New button and add as many addresses as you like. The default STMP address is bolded, with SMTP in capital letters. If you want to use a different address as the default, select it and press the Set as Default button.

If you need to add additional addresses to several user accounts, you should consider creating a new recipient policy or editing the current policy. Look for the recipient policies in the Exchange System Manager, under the Recipients, Recipient Policies container (Exchange 2000/2003) or Organizational configuration, Hub transport, Email Address Policies (Exchange 2007). To add new addresses for all users, change the Default policy or create a new one (Right click, New) and apply it to specific users using filter rules.

Enter %g@domain.com for first name only, %m@domain.com to use the username for the alias or
%g.%s@domain.com for firstname.lastname format. See http://support.microsoft.com/?kbid=822447 for other SMTP generation address formats available.

Office 2010 Technical Preview Registration

The Office 2010 beta, oops "Technical Preview", site is live at http://www.office2010themovie.com/. There isn't much there right now, except a link to register for the preview and links to the Office 2010 forum at TechNet and to their Office 2010 blog.

Anyone who is interested can register for the Office 2010 Technical Preview at https://microsoft.crgevents.com/Office2010TheMovie/Content/Default.aspx?p=Home& Remember: registering is no guarantee you'll get a preview copy of Office.

Even if you are not in the Office 2010 preview program, you can visit the forum at
http://social.technet.microsoft.com/Forums/en-US/office2010general/threads or the Office 2010 blog at http://blogs.technet.com/office2010/ to learn more about features and changes in the new version.