We've been subpoenaed to send all emails exchanged with a couple different individuals for a court case.

How would I go about doing this in an Exchange 2010 environment?


I would take a look at: Understanding Multi-Mailbox Search

  • 2
    @jim its insulting to throw a book at someone who asks a specific question May 31 '11 at 18:11
  • This has a lot of extra information in it that I don't need. However, I believe the functionality that I'm searching for is in this. Thanks for your help. May 31 '11 at 18:15
  • 8
    @i__, it's insulting to assume that it doesn't take a book to answer a question. As an example he wants to send messages between 2 parties for legal parties - woul dhe also like them to not be able to delete them? Would he like to be able to show proof that the search he did was conclusive? All of these issues are addressed in the article linked to. Simply performing a discovery search neither answers the question nor solves the problem. As Ben mentioned litigation hold is also covered in the article (which is probably more relevant than the search since the search could be invalidated).
    – Jim B
    May 31 '11 at 18:47
  • 8
    @I__ - if someone is involved in litigation issues then what would really be insulting is giving them a half-assed answer to what is a potentially very complex and costly problem, & then just walking away when it turns out that its actually a complex area & maybe they do need about a book's worth of information on the subject & related areas to prevent themselves from destroying evidence or ruining its validity as a useful document in court. Sometimes you need to "read a book" before acting, or read enough to gain an appreciation of how complex the situation is & hire a specialist.
    – Rob Moir
    May 31 '11 at 18:59
  • 1
    @jim and robert - anyone can do a google search. the point of this site is to get specific information, not links to long articles May 31 '11 at 21:42

You're wanting to perform a Discovery Search, also known as a Multi-Mailbox search. I'm going to assume use of the web-based ECP interface, but similar functionality is available from the shell.

First, the user account that needs to perform this needs to be in the Discovery Management role group. This group is by default empty, meaning even Exchange Administrators have no access to perform Discovery Searches when Exchange 2010 is installed. These roles can be modified in the Roles and Auditing portion of ECP. After you add a user to this group, you'll need to log out then log back in for it to take effect.

After you are in the appropriate group, a new option will appear in ECP within the Mail Control section called Discovery. The interface to perform this task is quite intuitive, save one part; you will need to specify a mailbox to copy the search results into. This is called a Discovery Mailbox, which is simply a locked-down mailbox with high quotas that is by default only accessible by members of the Discovery Management group.


I would add this: You should check with the legal department. They may want you to export entire PST files, and basically inundate the recipient. I have been involved where this has been the case. They did not want to make it easy for the other side by handing them only the e-mails they wanted.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.