Hello All,
We have a user who permanently deleted an email and wanted to recover it. I am trying to use Exchange Management Shell to restore the email. They know nothing about the email except it the day it was received into their Outlook mailbox.
Here is what I have done so far:
1) Verified Discovery Mailbox: https://docs.microsoft.com/en-us/exchange/create-a-discovery-mailbox-exchange-2013-help
Get-Mailbox -Resultsize unlimited -Filter {RecipientTypeDetails -eq "DiscoveryMailbox"}
2) Add user's permission to the Discovery Mailbox: https://docs.microsoft.com/en-us/exchange/security-and-compliance/in-place-ediscovery/create-a-discovery-mailbox
Add-MailboxPermission "Discovery Search mailbox" -User 'user name' -AccessRights FullAccess -InheritanceType all
3) Search and retrieve the deleted email:
Search-Mailbox "user name" -SearchQuery "received:'Mon 8/19/2019'" -TargetMailbox "Discovery Search Mailbox" -TargetFolder "Deleted Items" -LogLevel Full
However when I run this I get this error:
"WARNING: The Search-Mailbox cmdlet returns up to 10000 results per mailbox if a search query is specified. To return
more than 10000 results, use the New-MailboxSearch cmdlet or the In-Place eDiscovery & Hold console in the Exchange
Administration Center.
The KQL parser threw an exception.
+ CategoryInfo : InvalidArgument: (:) [], ParserException
+ FullyQualifiedErrorId : [Server='exchange server',RequestId=b6490c87-5110-471e-a3b8-e4d2e4bbcce0,TimeStamp=8/30/2019 8:21
:43 PM] [FailureCategory=Cmdlet-ParserException] A8DB946C
+ PSComputerName : 'exchange server name'
"
Please advise
thank you,
Brian