{"id":156,"date":"2007-09-19T23:29:43","date_gmt":"2007-09-19T21:29:43","guid":{"rendered":"http:\/\/www.corelan.be:8800\/index.php\/2007\/09\/19\/exchange-2007-indexing-and-searching-mailboxes\/"},"modified":"2007-09-19T23:29:43","modified_gmt":"2007-09-19T21:29:43","slug":"exchange-2007-indexing-and-searching-mailboxes","status":"publish","type":"post","link":"https:\/\/www.corelan.be\/index.php\/2007\/09\/19\/exchange-2007-indexing-and-searching-mailboxes\/","title":{"rendered":"Exchange 2007 : Indexing and searching mailboxes"},"content":{"rendered":"
\n
\n

The Exchange 2007 search engine has much improved over the index\/search engines that were available in Exchange 2000\/2003. The new search is less resource-hungry, fast, searched inside attachments, and is enabled out of the box. <\/p>\n

Enable\/Disable search <\/h4>\n

To enable or disable Exchange search, open the Exchange Management Shell <\/p>\n

\"091907_1730_Enabledisab1\"<\/a> <\/p>\n

Run the following command to see if search is enabled on a specific mailbox :
Test-ExchangeSearch <mailbox name><\/strong><\/span> <\/p>\n

or create a list of mailbox databases that are search-enabled :
Get-MailBoxDatabase | select name, indexenabled<\/strong><\/span> <\/p>\n

To enable search, run :
Set-MailboxDatabase <name> -indexenabled:$true<\/strong><\/span> <\/p>\n

To disable search, run :
Set-MailboxDatabase <name> -indexenabled:$false <\/strong><\/span><\/p>\n

To disable search on the entire server, you need to stop the Search Indexer service :
net stop "Microsoft Exchange Search Indexer" <\/span><\/p>\n

Keep in mind : if you run Outlook 2007 in cached mode, Exchange Search or Store search is not available. The entire search is then handled by the Windows Desktop search. In Outlook 2003, the client does a linear scan of every message. <\/p>\n

Test if search works <\/h4>\n

There's a neat powershell command that allows you to test if search\/index works as anticipated. By default, the searchtime timeout is set to 60 seconds, but in reality you should get results in less than 10 seconds. (so you could optionally speed up the test process by setting a timeout to 20 seconds or so, which will allow you to test a larger chunk of mailboxes using a script, in less time. Use the following command to run a test on all mailboxes on your server : <\/p>\n

Get-mailbox | Test-ExchangeSearch –IndexingTimeout 20 | Format-table <\/strong><\/span><\/p>\n

You'll see a green box in your powershell window, showing the progress of the TestSearch process : <\/p>\n

\"091907_1731_Indexingand1\"<\/a> <\/p>\n

When "ResultFound" returns "False" and the SearchTime field says -1, then search isn't working for that mailbox. <\/p>\n

Pay attention to any (other) errors when running this command. They should give you more background info as to why the search doesn't work for a certain mailbox. <\/p>\n

If you have multiple Mailbox Databases, you can use the following script to restrict the test to only a certain mailbox database: <\/p>\n

Get-Mailboxdatabase "Server\\Database" | Get-mailbox | Test-ExchangeSearch –IndexingTimeout 20 | Format-table <\/span><\/p>\n

My Exchange server is called "Apollo", the Mailbox Database is called "Mailbox database", so in my case, the command would look like this : <\/p>\n

\"091907_1731_Indexingand2\"<\/a> <\/p>\n

     <\/p>\n

What if search doesn't work ? <\/h4>\n

Outlook Web Access : if you get a message stating that "results will take a long time to appear because Microsoft Exchange Search is unavailable. Results will not include matches in the e-mail body<\/em><\/strong>", then you might have a corrupted index. Sometimes, when you migrate (or create) mailboxes, the initial index crawl results in a corrupted index. Use the powershell command to run a search test on each mailbox (as explained earlier in this post). Look at the "ResultFound" column, and at the SearchTime. You should see a problem for the user who reported the problem. <\/p>\n

Search indexes are not stored in Exchange databases. The search index data for a specific mailbox database is stored in a directory in the same location as the database files. The directory name follows the convention CatalogData-<guid>-<guid> where the first <guid> is the GUID of the database and the second <guid> represents the Instance GUID, which is used in the clustered scenario to distinguish between the nodes. The following is an example folder name : <\/p>\n

CatalogData-b56624f3-bf19-4463-926f-d4705ac3dd08-cc64dd2d-2428-4f12-bba2-79d6d34c4d27 <\/p>\n

The typical path for the .edb files and the CatalogData directory is C:\\Program Files\\Microsoft\\Exchange Server\\Mailbox\\First Storage Group\\. <\/p>\n

The search index can become unsynchronized with the database after a recovery if transaction log files are played into the recovered database. The Exchange search engine does not read the played log files into the search index. I've also seen instances where the index got corrupted during or after moving the mailbox from a 2003 server to a 2007 server. In these situations, you should rebuild the search index catalog. <\/p>\n

Follow this procedure to rebuild the search index catalog: <\/p>\n