Finally a tool for admins to search for terrorists among the colleagues. Who knows, they are all around us!

@Mats
Discovery Management such a revolutionary tool for searching notorious activity on internet huh??? Cool!!!

While it may help you search for terrorists, Mats, it does actually add benefit to those of us working at real-life companies with actual security requirements.

Is it just trhe compliance officer that needs the Enterprise Cal or does the orginisation need an ent cal for every user whose mail box is searched?

@Will: All mailboxes searched using Multi-Mailbox Search (from the Discovery console in ECP or using the New-MailboxSearch cmdlet) require an Enterprise CAL. Note, you can also search mailboxes synchronously, one at a time, using the Search-Mailbox cmdlet, which doesn't require an Enterprise CAL.

I know licensing questions are tricky but what if we are searching 100 mailboxes max at a time, and not using any other Enterprise features. Does that mean we only need 100 Enterprise CALs? Then search 100 different mailboxes in a subsequent session, basically sliding those CALs across mailboxes. Not expecting an official answer here (I know the best one is 'call Microsoft Licensing' or 'consult with your own lawyer for an opinion'), but just wishing there was somewhere with approved examples of scenarios like this.

@Frank T: What you essentially discussing is gaming the licensing strategy - of which Microsoft will not support.  

Add one more item to the Exchange 2010 Enterprise CAL confusion list.  now we have to guess how many mailboxes a compliancy officer might include in their search since Microsoft is now in the busness of licensing behavior not features.

I have a question on 'Message ID' field in the CSV file generated by EMS shell command 'New-MailboxSearch'  with -LogLevel Full. I did not see details documented anywhere. If this is not the best place to ask this question, please point me to the right place.

Questions on column 'Message ID'
1) Its format appears to be Base64 encoding. Is it right?
2) What MAPI property 'Message ID' map to?
Is it the PR_ENTRYID of the original message or the PR_INTERNET_MESSAGE_ID  or something else? I could not correlate 'MessageID' to any MAPI message property.

Thank you very much.