Share via


Modify an In-Place eDiscovery search in Exchange 2013

Applies to: Exchange Server 2013

After you create an In-Place eDiscovery search, you can modify it to change the search parameters. For example, you can change the mailboxes to be searched, date ranges, key words, logging options, or you can specify a different Discovery mailbox to store search results. Any changes you make to the search properties will be used when you restart the search.

Caution

If an In-Place eDiscovery search is running, you must stop it before modifying it. When you restart the search, the results from the last time the search was run are removed from the Discovery mailbox. However, the logs from previous searches are saved.

What do you need to know before you begin?

  1. Navigate to Compliance management > In-place eDiscovery & hold.

  2. In the list view, select the In-Place eDiscovery search you want to modify, and then click Edit Edit icon..

  3. In In-Place eDiscovery & Hold, you can modify the following settings:

    • On Name page, modify the name for the search and the optional description.

    • On the Mailboxes page, modify the mailboxes to search. You can search across all mailboxes or select specific ones to search.

      Important

      You can't use the Search all mailboxes option to place all mailboxes on Exchange 2013 Mailbox servers on hold. To create an In-Place Hold, you must select Specify mailboxes to search. For more details, see Create or remove an In-Place Hold.

    • On the Search query page, modify the following fields:

    • Include all user mailbox content Select this option to place all content in the selected mailboxes on hold.

    • Filter based on criteria Select this option to specify search criteria, including keywords, start and end dates, sender and recipient addresses, and message types.

    • On the In-Place Hold page, select the Place content matching the search query in selected mailboxes on hold check box, and then select one of the following options to place items on In-Place Hold:

    • Hold indefinitely Select this option to place the returned items on an indefinite hold. Items on hold will be preserved until you remove the mailbox from the search or remove the search.

    • Specify number of days to hold items relative to their received date Use this option to hold items for a specific period. For example, you can use this option if your organization requires that all messages be retained for at least seven years. You can use a time-based In-Place Hold along with a retention policy to make sure items are deleted in seven years.

      Important

      When placing mailboxes or items on In-Place Hold for legal purposes, it is generally recommended to hold items indefinitely and remove the hold when the case or investigation is completed.

  4. Click Save.

This example modifies the In-Place eDiscovery search Search-Project Contoso to search mailboxes belonging to members of the DG-ProjectManagers distribution group.

Set-MailboxSearch -Identity "Search-Project Contoso" -SourceMailboxes "DG-ProjectManagers"

How do you know this worked?

To verify that you have successfully modified an In-Place eDiscovery search, do one of the following:

  • Use the EAC to check properties of the search.

  • Use the Get-MailboxSearch cmdlet from the Shell to check the properties of the search. For examples of how to check the properties of a mailbox search, see the "Examples" section in Get-MailboxSearch.