Thanks in advance for reading & any help you can provide!

I'm trying to do a mailbox search against several mailboxes. I need to find all messages that mention some words AND don't mention other words EXCEPT when those words are on both lists. This is a complex search. I don't know how to twist the Keyword Query Language logic to accomplish this.

I recognize the search command will be complex and take a long time to run. That's fine.


Search for items that mention Teddy.
I want items that mention Roosevelt. I want items that mention mugwump
I want items that mention Rough Riders
I don't want anything that mentions Franklin Roosevelt.
BUT if a message mentions both Teddy and Franklin, I need that.
I don't want anything with "new-deal" in the subject
I don't want anything that mentions Truman.
I want to include wildcards.

Searching for "Roosevelt" will definitely bring in "Franklin." I can't unilaterally exclude "Franklin" without missing some "Teddy"

My current query:

New-MailboxSearch -SearchQuery "Teddy* OR mugwump* OR Roosevelt* OR 'Rough Riders*' NOT ((Franklin* NOT Teddy*) OR Truman* OR subject:'new-deal')"

Ran the above search. Received 9,500 hits. I found some e-mails with "mugwump" and "franklin pierce". Something's not right here.

Back when I ran "Teddy* OR Roosevelt*" I received 10,000 hits.
When I ran "Teddy* OR Roosevelt* NOT (Franklin* NOT Teddy*)" I received 9,500 hits. So I thought it worked?

In case it was a parenthetical issue, I also tried "(Teddy* OR Roosevelt*) NOT (Franklin* NOT Teddy*)". I still received 9,500 hits.
Bracketing the positive search terms didn't make a difference.

I then tried "(Teddy* OR Roosevelt*) NOT (Franklin*) I still received 9,500 hits. There were Franklin's in the results so something is really off here.

Is it a quotation problem? I can't find clear documentation on single quotes ' ' vs double quotes " ", vis-à-vis how they affect search operators and parentheses.
Microsoft's KQL documentation doesn't mention it. Most of the Google hits for KQL are for Sharepoint, which has a different bent (and options) compared to Exchange. A number of Exchange hits are actually for AQS.
I haven't found good examples of a complex KQL query like mine with nested search terms....
I tried swapping all of the single quotes with double quotes. It brought my results down to 4,000. It was just an -EstimateOnly, I haven't had a chance to run the actual job and inspect the results.

1. Will the "NOT (Franklin* NOT Teddy*) double-negative trip over itself?
2. Is there another way to say, "include this, unless it also includes that" ?
3. Is there a better way of arranging the parentheticals?
4. Am I doing something wrong with my quotations?
Thanks for your help!


According to your request, filter scope, "items that mention Teddy Roosevelt" including "items that mentions both Teddy and Franklin". you might simplify the cmdlet like below:

New-MailboxSearch -SearchQuery 'Teddy* OR mugwump* OR Roosevelt* OR Rough Riders* NOT (Truman* OR subject:"new-deal")'
  • Sorry, that won't work. I may not have explained clearly. According to your search, if an e-mail only mentions "Franklin Roosevelt" but not Teddy, it will come up your search. I want to ignore all Franklin unless it also says Teddy. Does that make sense? – R_C_III Feb 8 at 15:45
  • With my further research, your request that mentioning 'Teddy Franklin' is corrupt with excluding ''Franklin Roosevelt'. They cant be met at the same time. – Kelvin_D Feb 13 at 9:17

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.