Archiving Exchange 2013 mailboxes to PST via powershell

 https://community.spiceworks.com/how_to/102705-archiving-exchange-2013-mailboxes-to-pst-via-powershell

https://learn.microsoft.com/en-us/powershell/module/exchange/new-compliancesearchaction?view=exchange-ps

https://occasionalutility.blogspot.com/2014/03/everyday-powershell-part-17-using-new.html

Exchange 2013 has a license including a premium archive feature, but if you are still looking for a way to archive into external PSTs without launching the Archive feature on each Outlook, here's the way I do. I'd like to share it with you since it took really a lot of time to troubleshooting permissions and syntax.

Important note: this guide is as it is. I've made several tests before publishing it, but since Excahnge Powershell world changes very fast and documentation is usually an option, please make your own tests too before deleting items!

8 Steps total

Step 1: Create destination network share

Prepare a network share and assign full privileges to Exchange Trusted Subsytem

Step 2: Date/time settings to en-US

If you are working on a non en-US server, you need first to switch date/time settings to en-US, then run Exchange Powershell. Once powershell is running, you can turn back to your local date/time settings. This is due to a known bug in New-MailboxExportRequest cmdlet

Step 3: "Mailbox Import Export" and "Discovery Management" roles

The user who's running powershell must have Mailbox ImportExportrole for exporting mailboxes to PST. To assign it: New-ManagementRoleAssignment -RoleMailbox Import Export" -User <username>

Later on you will also need to delete the items you've exported, and to do that your user must be a member of Discovery Management group. I did it via ECP: Permissions > Discovery Management > Add member.

If these two permission updates haven't been done before, please restart powershell.

Step 4: Estimate

If you want, you can make estimates of the size and quantity of the items you're about to archive:

Search-Mailbox -identity <mailboxname> -SearchQuery 'Received<=2012-12-31 AND kind:email' -EstimateResultOnly

or:

1. New-MailboxSearch -Name <name> -SourceMailboxes <mailboxname> -SearchQuery 'received:2012-12-31 AND kind:email' -EstimateOnly
2. Start-MailboxSearch <name>
3. Get-MailboxSearch <name> | fl (you can see the size and a URL to see the specific items)
4. Remove-MailboxSearch <name> (when you're done)

Please have a look at the following steps for comments about filters and parameters.

Step 5: Export mailbox items older than a given date

New-MailboxExportRequest -Mailbox <mailboxname> -FilePath \.pst -ExcludeFolders #Contacts# -ExcludeDumpster -ContentFilter {(Received -le 12/31/2012 23:59:59)} -Name <pstname>

With the above command all mailbox items excluding contacts in \Contacts folder (I prefer them not to be in PST archives) and dumpsters (ie recoverable items) older than 12/31/2012 will be exported in <filename>.pst and that PST fill will be named <pstname>. Please pay attention to the date format (mm/dd/yyyy), since in the next step it will be different, due to different query languages. Unfortunately it looks like these languages change also on service pack releases.

Please note that in this and in the following queries Received includes also sent items.

Step 6: [Optional] Temporarily disable read receipts

In the next step we will delete several messages, and it's highly probable that some of them will be unread and asking for a read receipt. Before proceeding with the deletion, I suggest to disable read receipts from Exchange ECP > Mail Flow > Rules > New Rule > +: Create a new rule... > More options... > The message property includes the message type: read receipt > add other filters and actions you want.

Step 7: Delete items previously exported

Above step creates a copy of mailbox items in an external PST file, exactly as the Export tool in Outlook, so you need to delete the items you've exported. Unfortunately query syntax isn't the same, but I found this one to be matching.

Search-Mailbox -identity <mailboxname> -SearchQuery 'Received<=2012-12-31 AND kind:email' -DeleteContent

Parameter kind:email selects just email messages, leaving for example contacts and calendar untouched. In some documentation online you might find that AND operator must be written with a minus ahead (-AND), but I found it not working in my Exchange environment. Please pay attention to the date format, which now must be yyyy-mm-dd. I tried with yyyy/mm/dd and the filter didn't work: it deleted more items that it should, without any error notice!

Search-Mailbox will return only the first 10.000 items, so you might need to run it a couple of times.

Step 8: Cleanup

When you're done with the exporting, run the following command to cleanup the completed requests:

Get-MailboxExportRequest -Status Completed | Remove-MailboxExportRequest

I hope this basic tutorial can help other colleagues to save a lot of trouble and headaches troubleshooting this task! Ciao!