I came into a situation today where PowerShell again came to the rescue.
I needed a time and date for a mailbox move in the past. We performed these moves using ‘Exchange 2003 System Manager’ (ESM). Once the moves are completed ESM places a resultant .XML file in the profile of the logged on user in a “My Documents\Exchange Task Wizard Logs\” folder. Unfortunately this was over a month ago otherwise I could examine the Exchange system logs for the successful move EventID.
However using the PowerShell Select-String CmdLet I was able to scan all the resultant .XML files (Several hundred) in a matter of seconds for a “String” of the users ‘cn’ (Common Name). If found the Pipeline would output the text string where it found the “Search String” and also the file name and path of the file.
Using the creation date of the file I have an approximate date/time of the mailbox move.
Select-String "usercn" "\\ExchangeServer\c$\Documents and Settings\%UserProfile%\My Documents\Exchange Task Wizard Logs\*.xml" | Format-List *
Hope this helps.
All information is provided on an AS-IS basis, with no warranties and confers no rights.