This is a pretty granular blog post. Most of you will probably never use this but I had an incident happen recently where an email had to be found in an Exchange 2013 mailbox that had several hundred folders with rules spraying email everywhere. The search tools in Outlook would not work properly because the mailbox was too big. We had no time to fix the search tools in Outlook. We needed to find where the email was very quickly. Not where it was delivered, where it is right now. This will help you do the same.

First of all, forget all the GUI tools you have come to love in Exchange 2010 and older. You need powershell skills for the future of Exchange Admin work. I know a lot of you don’t like to hear that but it’s the reality for Microsoft Exchange, if not all Microsoft enterprise products going forward. Anyway, enough preaching. Let’s get down to business.

In our case we knew the subject of the email so this saved us some time. If this is the case for you, this will help a lot because it will get you right to the email. If this is not you, you might get a lot of emails returned in your search. I am only going to go over what we did because chances are you will probably know what you are looking for.

The command we want is Search-Mailbox. These are the parameters we want:

Search-Mailbox -Identity “UserAlias” -SearchQuery ‘Subject:”The Email Subject”‘ -TargetMailbox “EmailAdmin” -TargetFolder “inbox”-LogOnly -LogLevel Full

Simply edit this command to add your source mailbox user, the email subject, and the mailbox user you want the report sent to. That user will get a report based on the emails location. It will look something like this:

Then there will be an email with a csv attachment that will look like this:

As you can see this points you to the folder the email resides in, whether or not it has been read, and a bunch of other details.

Happy Hunting!