From Exchange 2010 SP1 onward, a new method is used to export and import mailbox data. Instead of forcing administrators to run Outlook on a mailbox server so as to be able to use Outlook’s ability to read and write PSTs, Exchange 2010 SP1 contains brand-new code for PST access and eliminates any need to run Outlook. This is a very good thing as it’s always best not to run applications designed for client computers on servers.
The new code is exposed through a set of cmdlets that mimic the approach taken for mailbox moves. In other words, you create a new request to export or import data, you can manipulate or view properties of a request, you can fetch request statistics, remove a request from the queue, and so on. The actual processing of the requests is performed by the Exchange Mailbox Replication Service (MRS) running on a Client Access Server (CAS), just like mailbox moves.
We are still getting used to the new implementation and it’s not surprising that we’re still discovering the breadth of the capabilities provided by its developers. One such example occurred recently when the question was posed as to the best way to export data for a particular date range. I think this is likely to be a pretty common request as you obviously don’t want to be forced to export the complete contents of a mailbox unless absolutely necessary, especially as mailboxes get larger and larger. No only would such an export take longer than required for a subset, it also exposes additional possibility that confidential user data might be compromised inadvertently. In other words, the fewer items that you export from a mailbox, the less chance that any item might be viewed by someone other than its owner.
At first glance, the set of available parameters for the New-MailboxExportRequest cmdlet don’t seem to include anything that can help, until you notice the hidden gem that’s buried in the ContentFilter parameter.
“For more information about filterable properties, see Filterable Properties for the -ContentFilter Parameter.“
There’s a huge range of filterable properties that can be explored. For this purpose the best parameter is “Received”, which takes date stamps as its input and allows you to search for items that match a particular date span.
Note: The New-MailboxImportRequest cmdlet does not support a ContentFilter parameter. This might be because it’s easier to implement a filter like this when dealing with server-based data that is already indexed (Exchange 2010 indexes every item in every mailbox automatically) whereas applying a filter to information held in a PST wouldn’t be as effective or efficient. The PST file format is, after all, not the greatest structure that the world of IT has ever seen.
As an example of date range filtering in action with New-MailboxExportRequest, this code looks for any item (in any folder) that has a received date in the range 2 March 2010 to 31 March 2010 from the “Pelton” mailbox [this is an update from the original post - see Matt's comment below]. Any items that are found are exported to a PST in the specified file share (FilePath). See this post for more information about configuring a network file share as a repository for mailbox import and export requests.
New-MailboxExportRequest -ContentFilter {(Received -lt '04/01/2010') -and (Received -gt '03/01/2010')} -Mailbox "Pelton" -Name DPeltonExp -FilePath \\ExServer1\Imports\DPelton.pst
Exporting a date range of items using New-MailboxExportRequest
Unfortunately there’s no GUI available for the New-MailboxImportRequest, New-MailboxExportRequest, and their associated cmdlets so everything has to be done through the Exchange Management Shell (EMS). Such is life. The good thing is that the possibility exists to export items using a date range and that we’ve learned more about the potential that lurks behind the ContentFilter parameter, but only for mailbox exports.
- Tony
Follow Tony @12Knocksinna
Hi Tony,
Your syntax is not entirely correct, you say that your export command will grab March 1 – April 1, however in reality it grabs everything between March 1 – April 1 (March 2 – March 31).
I use -ge (greater-than-or-equal-to) instead of -gt (greater-than) on the first day, this will always give you the full month of March. Of course if you needed to include April 1 as well you could use -le (less-than-or-equal-to) on the “high” side of the range in place of -lt (less-than).
PS> New-MailboxExportRequest -ContentFilter {(Received -lt ’04/01/2010′) -and (Received -ge ’03/01/2010′)} -Mailbox “Pelton” -Name DPeltonExp -FilePath \\ExServer1\Imports\DPelton.pst
Also you stated that will grab any item in any folder, it is important to note that this will not include sent items, since they were never “Received”. Below will grab both sent and received from all folders within the month of March.
PS> New-MailboxExportRequest -ContentFilter {(Received -lt ’04/01/2010′) -and (Received -ge ’03/01/2010′) -or (Sent -lt ’04/01/2010′) -and (Sent -ge ’03/01/2010′)} -Mailbox “Pelton” -Name DPeltonExp -FilePath \\ExServer1\Imports\DPelton.pst
-matt
Good catch and I appreciate you sharing your knowledge with the community. Thanks Matt!
Hello
I’ve got problem with use this in a script. It is look like:
$Date=Read-Host
New-MailboxExportRequest -Mailbox user -FilePath \\server\A$\User.pst -ContentFilter {(Received -lt ‘$Date’) -and (Sent -lt ‘$Date’)}
There is a problem with using variable $Date in ContentFilter.
———————
Error:
The provided ContentFilter value is invalid. ContentFilter is invalid. The value “$Date” could not be converted to type System.DateTime. –> The value “$Date” could not be converted to type System.DateTime.
———————
I tried with: ‘$Date’, $Date, “$Date” … still the same problem.
Do you have any idea how to solve this problem?
Kind Regard
Tomasz
PowerShell is complaining because the string in the $Date variable isn’t a valid date… I think you need some code to capture the date and format it properly to make New-MailboxExportRequest happy. Something like the code in http://powershell.com/cs/blogs/tips/archive/2008/12/31/converting-user-input-to-date.aspx should help.
TR
Hi Tomaz,
I had the same problem. The problem turned out to be the {} if you replace those with “” it will work just fine…
http://social.technet.microsoft.com/Forums/en-US/exchangesvradmin/thread/52866982-94b1-4e08-ae0d-9e42c88c9ae8
I consider it either a documentation bug or a real bug… The help files reference using the curly braces, which is I am sure where you got it from (as did I).
-matt
Is it possilble to MOVE the messages to the PST rather than just copying them?
It would be a two stage process. First, copy the messages to the PST and then search the mailbox (using Search-Mailbox) for the same messages and remove the content (pass the DeleteContent parameter)
TR
My export command and search results command are producing different results. Would you happen to know why?
In my Test scenario there should be exactly 1 message that is exported from this query. It is not exported. The search query does delete 1 message however.
Export:
New-MailboxExportRequest -ContentFilter {(Received -ge ’02/01/2012′) -and (Received -le ’02/08/2012′)} -Mailbox “MailboxName” -Name MailboxExportName –FilePath “Path to PST”
Search:
Search-Mailbox MailboxName -SearchQuery “Received:>= $(’02/01/2012′) and Received:<= $('02/08/2012')" -DeleteContent
The commands look good. It’s impossible to understand why you’re seeing a difference without examining the properties of the item.
TR
I got it. I needed to include the time stamp as well.
New-MailboxExportRequest -ContentFilter {(Received -ge ’02/01/2012 00:00:00′) -and (Received -le ’02/10/2012 23:59:59′)} -Mailbox “MailboxName” -Name MailboxExportName –FilePath “Path to PST”
Great stuff. Thanks for updating. Looks like there’s a difference in sensitivity between the two sets of cmdlets. I’ll let the Exchange team know.
TR
I have a furter question about the need to “Move” ….
Previously with Export-Mailbox I could use the Deletecontent parameter in a single command line, is this still possible with the new cmdlet?
To be fair, I don’t know if the previous syntax actually ran the process twice (ie once to export and then repeated to delete), or whether it did it as one operation.
Reason I need this, I have a few users with massive mailboxes that I need to export by year to a pst file to hand back to them (they are not capable of doing this themselves – read “senior management”)
Cheers
S
You can’t delete content with New-MailboxExportRequest… you’ll have to export the data and then delete it with Search-Mailbox!
TR
Thanks Tony – at least the new process seems to run a lot faster than the previous method, so although it’s a two step procedure, it is quicker overall.
I guess I need to look at scripting it into one action – not my forte, but might as well bite the bullet !
Rgds
S
Hi Tony – I was hoping you can help me with an issue I’m having when running the following command:
New-MailboxExportRequest -ContentFilter {(Received -lt ’10/21/2011 11:59:00 PM’) -and (Received -ge ’10/20/2011 12:00:00 AM’)} -Mailbox “mailbox2011″ -Name mailbox2011Exp -FilePath “\\server\2011Exp\2011export.pst”
‘m getting a “The value “21/10/2011 11:59:00 PM” could not be convered to type System.DateTime.
Any suggestion as to what is the problem with the command? Thank in advance for your assistance.
Hi Fred,
I noticed a couple of things…
1) I am assuming that you are in a country (or using a keymap from) where dates are commonly referred to DD/MM/YYYY instead of the more US way of MM/DD/YYYY. I am making this guess based on the inversion of the date in the error. So I would try to flip that around in your command.
New-MailboxExportRequest -ContentFilter {(Received -lt ’21/10/2011 11:59:00 PM’) -and (Received -ge ’20/10/2011 12:00:00 AM’)} -Mailbox “mailbox2011″ -Name mailbox2011Exp -FilePath “\\server\2011Exp\2011export.pst”
2) I think you might have the same problem as Tomasz above, try replacing your {} with “” around your content filter. If you are not running this in a script, then it is most likely the first option.
New-MailboxExportRequest -ContentFilter “(Received -lt ’10/21/2011 11:59:00 PM’) -and (Received -ge ’10/20/2011 12:00:00 AM’)” -Mailbox “mailbox2011″ -Name mailbox2011Exp -FilePath “\\server\2011Exp\2011export.pst”
http://social.technet.microsoft.com/Forums/en-US/exchangesvradmin/thread
Also /52866982-94b1-4e08-ae0d-9e42c88c9ae8
Tony, thanks for the prompt response. I’m actually located in Canada, so I believe I’m using the right date format. I tried your suggestions without avail, on both instances I get the following:
The provided ContentFilter value is invalid. ContentFilter is invalid. Invalid filter syntax. For a description of the
filter parameter syntax see the command help.
“(Received -lt ’10/21/2011 11:59:00 PM’) -and (Received -ge ’10/20/2011 12:00:00 AM’)” at position 15. –> Invalid filt
er syntax. For a description of the filter parameter syntax see the command help.
“(Received -lt ’10/21/2011 11:59:00 PM’) -and (Received -ge ’10/20/2011 12:00:00 AM’)” at position 15.
+ CategoryInfo : InvalidArgument: ((Received -lt ‘…1 12:00:00 AM’):String) [], ContentFilterInvalidPerm
anentException
+ FullyQualifiedErrorId : 969E9606
All I want to do is to be able to export data from a mailbox based on date. Any other suggestions are greatly appreciated.
This worked for me… Exchange 2010 SP2 RU2:
New-MailboxExportRequest -ContentFilter {(Received -ge ’10/20/2011 00:00:01′) -and (Received -le ’10/21/2011 23:59:59′)} -Mailbox “Mailbox2011” -Name Mailbox2011 –FilePath “\\server\2011Exp\2011export.pst”
Tony, still got the same error I posted in my previous reply.
Hi Fred,
Right now I don’t have access to a server and won’t have until I come back from TEC in San Diego. So I am limited to the Internet (for those that are interested, Exchange Online in Office 365 doesn’t support the New-MailboxExportRequest cmdlet for tenant administrators, for obvious reasons). I suggest that we go back to first principles and consult TechNet. http://technet.microsoft.com/en-us/library/ff601762.aspx provides advice as to the correct use of the -ContentFilter parameter. The example offered there is:
-ContentFilter {(Sent -lt ’01/01/2010′) -and (Sent -gt ’01/01/2009′)}
Try using that (just to get the syntax right) and then move on to change the “Sent” to “Received” (shouldn’t be an issue), the comparison operators from “gt” to “ge” (can’t see an issue there). Make sure that syntax works for you. Finally, change the dates. This step by step method will prove each element of the command.
Sorry that I can’t do more to help but the demands of travel make it impossible.
TR
I am having the same problems. I’m wondering if there is a bug when handling non-US date format? (I am in Australia – DD/MM/YYYY)
New-MailboxExportRequest -ContentFilter {(Received -lt ’06/27/2012′)} -Mailbox archive -FilePath \\server\share\tom\archive02.pst
I have to americanise the date to get the request to queue, but after 5 minutes it will fail with:
“The value “27/06/2012 12:00:00 AM” could not be converted to type System.DateTime.”
Hmmm… Have you tried putting the date and time into a variable and using the variable with New-MailboxExportRequest to see whether that does the trick? It seems like you might be running into some sort of format mismatch between submission (maybe on a PC running an Australian version of Windows?) and execution (on a CAS server running what locale for Windows?). It’s possible that the two run different locales and so cause some problems.
If not, Paul Cunningham runs ExchangeServerPro.com (or @ExchServPro) out of Australia and has posted a lot of sample PowerShell for people to share. He might have some insight into the problem of working with dates and times on an Australian server.
TR
I was having the same issue. I finally got it to work with the following syntax:
New-MailboxExportRequest -ContentFilter {((Received -le ’07/12/2012′) -and (Received -ge ’06/18/2012′)) -or ((Sent -le ’07/12/2012′) -and (Sent -ge ’06/18/2012′))} -Mailbox “MailboxName” -Name MailboxNameExp -FilePath \\server\exports\mailboxname.pst
Notice the double parenthesis, they are necessary and the -le must be first, then the -ge. Hope this helps.
Tony, that’s great info and much appreciated. I’ll go through it, btw good idea in changing the background on you blog as it was a bit difficult to read with the provious one.
Anyone ever come up with a New-MailboxExportRequest command that exported e-mails from a specific folder like SENT ITEMS, that were also of a specific DATE RANGE?
It doesn’t seem that New-MailboxExportRequest has a switch for this? This used to be doable including deleting those e-mails from the folder before the implemented SP1. Please tell the Exchange team bring this back!
I’ve tried the Sent filter only and it also retrieves all e-mails “sent TO” the mailbox owner (e.g. John Doe) at the specified date range. I only want to extract the e-mails specifically sent BY the mailbox owner. (e.g. All e-mails sent by John Doe and not including any e-mails sent TO John Doe. It’s just so frustrating… I’ve been going into the mailboxes of users through OWA to do this manually… painful.
Any help would be very much appreciated.
Well, the -IncludeFolders parameter for New-MailboxExportRequest will allow you to limit the export to just one or more specific folders, including Sent Items, and the -ContentFilter parameter allows you to specify a date range. Have you tried playing with these parameters? The ContentFilter accepts a filter such as Sender -eq “Tony” to extract messages specifically from one person. I’m afraid that I can’t be of more help as I’m on the road (Atlanta airport, actually).
TR
I believe I may be going loopy here
My version of Exchange 2010 SP2 RU2 does not seem to have the New-MailboxExportRequest cmdlet available….Version 14.2 (Build 247.5)
I believe in one of the comments above you mentioned you are also running this build and it works fine for you?
I get the following error:
The term ‘New-MailboxExportRequest’ is not recognized as the name of a cmdlet, function, script file, or operable program.
The term ‘Get-MailboxExportRequest’ is not recognized as the name of a cmdlet, function, script file, or operable program.
Hi,
If you don’t assign the RBAC “Mailbox Import-Export” role to your account, you won’t see the cmdlets available to you when you attempt to run them. This looks like you have run into the problem because the role is not assigned automatically, even to organization administrators.
From page 749 of my book:
New-ManagementRoleAssignment –Group ‘Group allowed to Import Export Mailboxes’
–Role ‘Mailbox Import Export’
TR
Ha! Spot on, I completely forgot to give myself the MB Export Role…
Thanks!
Great book by the way.
Great. Always good when a theory works…
Hi All,
I just use the following command to export all emails that are from 1 January 2011 or older:
New-MailboxExportRequest -ContentFilter {(Received -le ’01/01/2011′) -Or (Sent -le ’01/01/2011′)} -Mailbox “username” -Name username -FilePath \\Server02\c$\temp\UsernameEnd2010.pst -IsArchive
This command run perfectly and the pst file filled. After that I run the DeleteContent command to delete all emails of 1 January 2011 and older that have been Send or Received from the Archive Mailbox:
Search-Mailbox -Identity “Username” -SearchQuery {(Received -le ’01/01/2011′) -Or (Sent -le ’01/01/2011′)} –DeleteContent
ALL Emails of Mailbox and Archive Mailbox were deleted :S even emails younger then 1 Januray 2011. What did I do wrong ?
Greetings Paul
Hi Paul,
It’s impossible to know what happened here without access to the data. I suggest that you 1) examine some of the items in the archive mailbox with MFCMAPI to establish exactly what values are held in the various properties that you want to filter on and then 2) run some tests with Search-Mailbox (with logging turned on) to establish results that you get against the data. This way you’ll be able to compare the effects of your commands against known data and come to some conclusions.
TR
Hi Tony,
Thanks for your quick reply.
After investigation I found the problem. Seems that a query “{(Received -le ’01/01/2011′) -Or (Sent -le ’01/01/2011′)}” is incorrect and seems to see as all emails in mailbox and archive mailbox. The correct query is “Search-Mailbox -Identity “Username” -SearchQuery “received:<01/01/2012 and sent:<01/01/2012" –DeleteContent"
To make sure you use the string right use your own Outlook to make this string. See link for more explaination:
http://msmvps.com/blogs/andersonpatricio/archive/2012/04/02/how-to-delete-messages-using-search-mailbox-in-exchange-server-2010.aspx
Greetings Paul
Great. Well done for tracking down the root cause. That always leads to a warm feeling!
TR
Hi Tony,
Do you happen to know if I can rerstore emails that have been deleted with the SearchQuery -DeletContent option? Because using the SearchQuery option and restore all content back I cannot see all emails. The date range is correct.
Greetings Paul
I don’t actually know if -DeleteContent is a “hard” or “soft” delete. If it’s soft, you should be able to log onto the mailbox and use the recover deleted items feature to retrieve the info. If hard, you’ll have to recover from a database backup. You can restore a backup to a different disk and mount it as a Recovery Database to get the info back.
TR
This certainly is a scary way to archive user’s email. One wrong date range and Ill delete their whole mailbox! I wish microsoft would leave us with a better option…
Is there a log that will show why these commands would Fail? I am running the following command and it is failing:
New-MailboxExportRequest -ContentFilter {(Received -lt ’07/19/2012′) -and (Received -gt ’07/11/2012′)} -Mailbox “amills” -Name AMILLS_Second -FilePath \\PRO19-HP\ExchangeExport\amills_2.pst
AFAIK, there are no logs available. Try running the command with the -Verbose switch to see if anything particular is complained about. Alternatively, build the command up piece by piece to ensure that your syntax is correct for every piece. I’m assuming that you’re running with an account that has been assigned the Mailbox Import-Export RBAC role and that the PST file is going to be put in a file share that’s available to the Exchange Trusted Subsystem?
TR
The failed EMS cmdlets get logged by Windows server Event Viewer under Microsoft Application & Services, under the category name: MSExchange Management, however the details aren’t very helpful!
Does the following command remove only e-mail messages or does it also include contacts and calendar events as well?
Export:
New-MailboxExportRequest -ContentFilter {(Received -ge ’02/01/2012′) -and (Received -le ’02/08/2012′)} -Mailbox “MailboxName” -Name MailboxExportName –FilePath “Path to PST”
Search:
Search-Mailbox MailboxName -SearchQuery “Received:>= $(’02/01/2012′) and Received:<= $('02/08/2012')" -DeleteContent
All items are exported by the New-MailboxExportRequest cmdlet if you include all folders. AFAIK, the Search-Mailbox cmdlet should export all items that meet the search criteria. You might have to play around for a while to get the exact set to use, but it should be possible to export calendar and contact items as well. The search terms “kind:contacts” and “kind:meetings” can help you identify specific contact and meeting items.
TR
Hey everyone, I’m getting some issues running the very first sytnax with a date range for received and sent items. The error I’m getting is “The provided ContentFilter is invalid. ContentFilter is invalid. Invalid filter syntax” This is a straight copy and paste into notepad, changed the parameters, mailbox, location, etc. Any ideas?
Don’t cut and paste direct into PowerShell. Often it works just fine, but my observation is that PowerShell doesn’t like recipient filters and similar pasted in. Type the filter from scratch and see if that works.
TR
Pingback: Moving messages to .pst in Exchange 2010 | B A R R Y
When we export anything with the new-mailboxexportrequest and view the PST with a third party tool like Kroll ontrack the create date for the message is the date of the collection, the date the pst was exported. If the PST file is accessed with Outlook the dates are the actual dates associated with the messages.
Has anyone else seen this behavior? If so is there a way to configure the export to report actual dates from the messages instead of the date the export ran?
Hi!
I have used the export with different timeframes without any problems regarding mails. But I have seen holes in the users calendars from this type of export. Do we need to add any extra commands to make sure we have all calendar items and contacts etc?
Not to my knowledge. Can you point to any pattern that might identify the missing items?
TR
To give you some info first:
We have migrated a customer from their own systems over to our solution. Both running Exchange2010. We startet with taking out all mail >2013 and proceeded with taking the rest when we performed the actual migration.
It seems like it’s meetings connected to MeetingRooms that are generaly missing from peoples calendars.
Magnus
You mean meetings associated with room mailboxes? If so, I would document the issue and report it to Microsoft to see what they say.
TR
Yeah, that’s what I mean. I will see what I can do about it. Thanks!