Exchange 2013 - Discovery Search Mailbox Cleanup - Delete Search Folders

Question

this is interesting, i couldn't find a simple way to delete search-folders from "Discovery Search Mailbox". The search-folders were created when I ran "Search-Mailbox" command on any user-mailbox to do some search.

Some one said to use ECP and use mail-control, but I am on Exchange 2013 and I have EAC, there is no mail-control.

https://social.technet.microsoft.com/Forums/Lync/en-US/d19585f5-19bb-4f9b-a22e-724b2758183e/discovery-search-mailbox-how-do-i-clean-it-up-after-a-search-was-completed?forum=exchangesvradminlegacy

the other way is to delete and re-create the default discovery mailbox in Exchange. I do not want to delete the whole discovery mailbox to just remove a folder which was created by search.

https://technet.microsoft.com/en-us/library/dn750894(v=exchg.150).aspx

i cannot delete it in Outlook as it give me permission denied message. when checking permission, it shows only "default" and "anonymous" with "None" permission level. i could add my name though, but it only applies to that folder only, the child folders not inherited, and even after giving me permission as owner, i am not able to delete (which may be ok because child folders in the tree does not have my name as owner). i dont see the Discovery Search Mailbox in OWA.

I am on Exchange 2013. On server I have EAC (Exchange Admin Center) but not ECP. On EAC i do not see mail control feature. This should have been a simple task or command to just remove search-recovery folder from "Discovery Search Mailbox". I have four folders in that mailbox for the same search query, each time a different target folder. One of them was created from "in-place eDiscovery & hold" menu in EAC. I can delete that saved-search under "in-place eDiscovery & hold" and that will probably delete the folder (I am not sure about this part), but the other three folders were created by search-mailbox command (similar search queries on same user-mailbox) and using different target folder in "Discovery Search Mailbox", how do I remove those? There should be some powershell commands to remove those folder. I am not sticky to powershell commands only, as long as the folders are removed and mailbox is cleaned-up.

I need help. How do I make it work?

Answer 1

Did you already find a way to do this? I know it's been a few months, but there are a few ways to do this, none of them explicitly "simple". Option 1 is the easiest way to delete the results of a specific search. Option 2 clears everything!

There are ways to use Exchange Web Services (EWS) to target a specific folder, but that's a lot more to document and quite honestly, unless you have to deal with a LOT of Discovery Searches, this should do and may even give you some ideas for procedures of your own.

I am on 2016 and it's been a bit since 2013 so forgive me if this does not go EXACTLY to plan and I am very VERY busy all the time and I may not see any questions you have, I will try and keep an eye on the thread though.

This will require PowerShell to your Exchange Server(s) or Office 365 Tennant.

1. Get the name of your Discovery Search Mailbox(es) - going to refer to these as DSM going forward.

   Get-Mailbox -Resultsize unlimited -Filter {RecipientTypeDetails -eq 'DiscoveryMailbox'} | Format-Table DisplayName, PrimarySmtpAddress -AutoSize
   

Option 1

2. Grant yourself access to the Discovery Search mailbox - replace "" with a display name result from the list. Replace "" with your primary smtp email address on Exchange 2013. Remove the -AutoMapping:$false if you want to see this DSM in Outlook automatically (can take a bit to appear). I prefer to work with this separate via OWA.

   Add-MailboxPermission '<DisplayName>' -User <your exchange email address - primary>' -AccessRights FullAccess -InheritanceType all -AutoMapping:$false
   

3. Now go to Outlook (if you removed AutoMapping) or OWA if you did not

4. In OWA click on your User Name/Avatar in the upper right, and open another mailbox

5. Type the PrimarySmtpAddress of the DSM from step #1 above in the field indicating which mailbox to open and GO.

6. Delete the folders/items you need to and then empty the recycle bin

7. Clean the dumpster of the DSM. You may have to run this a few times since only the first 10,000 results will be processed in the search. Replace "" with the DSM's primary smtp address from step #1 above.

   Get-Mailbox -ResultSize Unlimited -Filter {PrimarySmtpAddress -eq '<PrimarySmtpAddress>'} | Search-mailbox -DeleteContent -Force -SearchDumpsterOnly
   

This last step will clear everything JUST from the dumpster (the deleted deleted items).

Option 2

Just run a modified step 7 from above. Replace "" with the DSM's primary smtp address from step #1 in option #1 above.

Get-Mailbox -ResultSize Unlimited -Filter {PrimarySmtpAddress -eq '<PrimarySmtpAddress>'} | Search-mailbox -DeleteContent -Force -SearchDumpster

This will process the first 10,000 results and you may have to run it more than once. It will give you some idea of what it did at the end of processing. If the result is 10,000 items, run it again, it needs to be either zero or some number LESS than 10,000 for everything to be gone.

Again, super busy, but I thought I could help if you still needed it since this is what I did on Exchange 2013 and now 2016, did not have to change any processes (except if Office 365 is involved, then you have to connect to the service first).

Answer 2

Remove-Mailbox "DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}"

https://technet.microsoft.com/en-us/library/dn750894%28v=exchg.150%29.aspx?f=255&MSPPError=-2147217396