Search-Mailbox SearchQuery not working

Question

I am trying to delete the contents of an Exchange 2013 mailbox before today's date. It must be specific to the second I call the Get-Date cmdlet.

This code runs without error:

Search-Mailbox myID -SearchQuery Received:<Get-Date -DeleteContent -Force

When executing this, I see the search progress bar in PowerShell, except no data is found. I have triple checked the mailbox I am working with and it has data older than 4/24/14/ hh:mm:ss.

---

I have tried countless variations, an example being:

Search-Mailbox whism_j -SearchQuery "Received:<$((Get-Date).ToString("yyyy-MM-ddTHH:mm:ssZ"))" -DeleteContent -Force`

This command does not execute, as I get an The property keyword isn't supported error.

Answer 1

Why your code is not working:

Search-Mailbox myID -SearchQuery Received:<get-date -deleteContent -force

This doesn't work because get-date is parsed as a literal string; you're not interpolating the results of the Get-Date cmdlet. -SearchQuery is a string parameter, and PowerShell implicitly interprets arguments to string parameters as double-quoted strings. To interpolate the results of Get-Date, use -SearchQuery Received:<$(Get-Date).

Search-Mailbox whism_j -SearchQuery "Received:<$((get-date).toString("yyyy-MM-ddTHH:mm:ssZ"))" -deleteContent -force

This doesn't work because the date format isn't valid. You might infer that it should be based on the AQS documentation, but in fact the date in Search-Mailbox queries needs to be in a format that conforms to the Exchange server's regional settings.

How to do it:

You might be able to get away with simply interpolating the results of Get-Date:

Search-Mailbox id_attribute -SearchQuery "Received:<$(Get-Date)" -DeleteContent -Force

However, this will only work if the format used when a DateTime object is interpolated into a string, which is MM/dd/yyyy HH:mm:ss, matches the regional format. To ensure that you're getting the right format, use Get-Culture to determine the right format string, and supply that to Get-Date's -Format parameter:

If you want to use today's date, you could use Get-Date and then convert it to a string as RickH suggested, but that's not necessary, because AQS support named relative dates, including today:

$format = (Get-Culture).DateTimeFormat.ShortDatePattern + ' ' + (Get-Culture).DateTimeFormat.LongTimePattern
Search-Mailbox myID -SearchQuery "Received:<$(Get-Date -Format $format)" -DeleteContent -Force

_{Note that, as implied by what I said above, the external double quotes aren't strictly necessary if the argument doesn't contain spaces that aren't within parentheses, but I think it's good practice to include them.}

---

For completeness and the benefit of future searchers, it's worth mentioning that AQS also accepts named relative dates such as today, this week, or last month, so this should also work:

Search-Mailbox id_attribute -SearchQuery "Received:<today" -DeleteContent -Force

I didn't provide that as part of the answer because in a previous (deleted) version of the question the OP specifically asked how to search from messages before an exact time, and today is just the current date without a time.