Hello, Exchange 2010 SP2. Our domain is "domain.com" Using ECP, I have created a seach querry to seach a mailbox called mailbox1 for any email seant where the to field has users inside the company (domain.com) as well as external users. I am using the below AQS but it does not get any hits even though there are messages that have this criteria. Any ideas? In the keywords section I have: not to:@domain.com and to:@domain.com

Anyone??? Basically what we need to do is a search in a mailbox for any messages that have both internal and external users in the TO field at the same time. Transport tracking logs are not an option here because of the time window which is beyond what we have in the logs.

Hello, You cannot use not like or not to in this command. As for a workaround solution, you can first find all the emails with 1. internal address 2. both and internal address and external address by the following command: Search-Mailbox -Identity "xxx" -SearchQuery 'To:"@domain.com"' -TargetMailbox "xxxx" -TargetFolder "xxxx" Then manually delete the emails that only have the internal address in the To: filed. Thanks, Simon