Using the word phrase search

The following table outlines the properties that can be used to define an AQS query using a word phrase restriction:

Property	Examples	Description
Attachments	attachment:report.xlsx attachment:salesreport.docx attachment:pptx attachment:*	Searches for items that have an attachment with a specific name, such as report.xlsx or salesreport.docx. You can include partial filenames, as shown in the third example, to find all messages with a certain extension. The file body of any attachments will also be searched. The last example finds all messages that have any attachment.
Cc	Cc:administrator Cc:[e-mail]	Searches for items where administrator or [e-mail] is included in the carbon copy line.
From	From:Bob From:Bob Smith	Searches for items sent from Bob or Bob Smith.
To	To:Bob To:Bob Smith	Searches for items sent to Bob or Bob Smith.
Bcc	Bcc:Bob Bcc:Bob Smith	Searches for items where Bob was included in the blind carbon copy line.
Subject	Subject:sales Subject:(Sales Meeting)	Searches for items with the word "sales" in the subject line. Searches for items with the words "sales" or "meeting" in the subject line.
Body	Body:financial Content:financial	Searches for items where the word "financial" appears in the message body.
Participants	Participants:Bob Smith	Searches for items with Bob Smith in the To, Cc, or Bcc fields.
RetentionPolicy	Retentionpolicy:critical	Searches for items that have the critical retention tag applied.
(Not Defined)	Financial Report	Searches for items that contain both "Financial" and "Report" in all word phrase properties.

When performing a word phrase search, the property names and search terms are case insensitive. If you want an exact match, enclose the search query in double quotes, otherwise the search will default to a prefix match. For example, searching for the term report would match the word reporting unless enclosed in double quotes, indicating an exact search.

Examples

If you want to delete all the messages in the administrator mailbox where the sender's e-mail address is <[e-mail]>, use the following code:

Search-Mailbox -Identity administrator `
-SearchQuery "from:[e-mail]" `
-DeleteContent `
-Force

If you want to create a discovery search based on messages that contain the phrase Employee Salary in every mailbox, use the following code:

New-MailboxSearch -Name MySearch `
-TargetMailbox "Discovery Search Mailbox" `
-SearchQuery 'Body:"Employee Salary"' `
-MessageTypes Email `
-IncludeUnsearchableItems `
-LogLevel Full