Mark Minasi's Windows Networking Tech Page
Issue #92 November 2011

Document copyright 2011 Mark Minasi; please see below for info on subscribing, unsubscribing or copying portions of this text.

What's Inside

  • News
    • Learn with My Seminars, Audio Recordings and More!
  • Tech Section
    • Finding Files on Windows 7 and R2 Systems:  Cracking the Code on Desktop 4's Advanced Query Language
  • Conferences
  • To Subscribe, Unsubscribe, Read Old Newsletters or Change Your Email Address

News

Hi all —

Readers, clients and attendees to my keynote talks and classes ask me a lot of questions about Windows, and oftimes I find myself answering the same small number of questions over and over again.  This month, I want to answer one of those questions: "where'd the 'Advanced Search' options go in Windows Search?"  It's essentially gone in Windows 7 and Server R2, but Microsoft has replaced it with a tool that lets you find files on your desktop or your server's hard disks using what Microsoft calls their Advanced Query Language.  That sounds sort of scary, but trust me, it's useful once someone explains it to you -- which I'll do in this issue.  But first, a word from our sponsor...

.

Don't Miss ITEdge Intersection!

Windows Server 2016 is coming, are you ready? Server 2016 and many other important topics are the focus of ITEdge Intersection at the MGM Grand in Las Vegas, Oct 25-29. Your favorite speakers are there, including Scott Guthrie, Brad Anderson, Jeffrey Snover and of course, Mark Minasi. Register today for the conference and a workshop and you can go home with an XBOX One S, Surface 3 table or MS Band 2. Register at www.itedgeintersection.com.

Bring Mark's Windows 10 Support Class and Our PowerShell Classes to Your Site

Mark has delivered his new "Deploying, Managing and Securing "the Last Windows: Working with Windows 10" class to nearly a dozen clients, and the reviews are uniformly great.  Designed for the Windows 7 support pro, this course tells you everything you need to know to support, deploy, or manage Windows 10 systems.  Fast-paced, lecture-based and entertaining, this course gives you the shortest path to Windows 10 expertise. Learn about Windows 10's completely new licensing approach.  See how to enable the new "parallel universe" security tools.  Discover the cloud-y new tools in Windows 10 like joining a system not to an Active Directory but instead to a cloud.  Find out what you can learn at our course outline at http://www.minasi.com/w10class.htm. 

To bring this class to your site, just drop us a line at assistant@minasi.com.

And while you're at it, are your folks PowerShell adepts?  There really isn't a productivity-enhancer available for Windows support people like PowerShell.  Bring Mark's "Learning PowerShell: Hands-On with AD, Networking, and More" class to your site and he'll make your command-line-hating techies into PowerShell fans.  Outline at http://www.minasi.com/Posh2day/. 

Finding Files on Windows 7 and R2 Systems: Cracking the Code on Desktop 4's Advanced Query Language

Anyone who uses Windows Explorer has, at some time, needed help in finding a file or files on their system's hard drives, and the reality of laptops with a terabyte of more of disk space hasn't made that any less relevant.  For simple queries, it's pretty easy to figure out how Explorer helps you find things graphically: 

  • Click on any of the column headings to sort by date, size, name or the like;
  • Click a second time to convert an ascending sort to a descending sort or vice versa; and
  • Right-click the headings bar and choose "More..." to add almost any file attribute to the Explorer window.

Sometimes, though, we want to assemble a more complex query.  "Let's see... I wrote that PowerPoint about Active Directory replication somewhere between January 2002 and June 2005, it's got the phrase 'high-watermark' table in it, it's got to be somewhere on my hard disk...," that sort of thing.  That's when you notice that text box in the upper right-hand corner of the Explorer window that says in faint gray letters "Search ," followed by the folder name.  If only I had that useful dialog box from XP and 2003 ... remember this?

Ah, those were the days! But if we take a few moments to learn how 7 and R2's Search fields, we'll soon see that we've got a more powerful search ... and thereby hangs our tale.  Over the years, Microsoft's been quietly trying to move us over to a search system that tries to canvass your computer and produce quick responses to well-formed "where the heck did I put..." questions.  Its latest incarnation is called Desktop Search 4.0, and if you decide that you really like it, you can download versions for 2003 and XP.  Here's how it works.

Don't Turn Off Windows Search Service

First of all, Desktop Search wants, as I just said, to find your desired files quickly.  Database folks have known for ages that the easiest way to quickly search a database is by taking the time to scan it and index it beforehand, and the creators of Desktop Search employ that same tactic through the work of the Windows Search Service.

Hang on, I hear you cry... indexing?  As in the infamous Index Service?  Well, sort of yes and no.  The Index Service appeared in Windows 2000 and attempted to run in the background, indexing every file on your system.  It drove all of us nuts because we'd walk away from our computer for a few minutes, only to return and find the hard drive furiously working.  "Virus?  Malware?  Trojan?," we thought, and started up Task Manager to start searching for the miscreant, only to find that as soon as we touched the mouse, the drive activity stopped.  Now, I don't know about you, but that convinced me that I was definitely infected with something.  A bit of research soon showed me that the Index Service was the culprit, a bit more research showed that the Index Service wasn't doing much of anything for me except stealing cycles, and so I turned it off, like most of you.

So, when Vista appeared, I noticed that the Index Service had disappeared, and something new called the "Windows Search Service" had appeared.  Hmmm, I thought... just a bit of Microsoft skullduggery?  An underhanded way of simply "changing the names to protect the guilty?"  A bit more research revealed that nope, Windows Search Service is a much smarter, more useful version of the Index Service, for three reasons:

  • First, it doesn't try to index the whole hard disk.  Index Service indexed your Windows folder and its 40 zillion attendant files, none of which you ever want to search on.  ("Explorer, please find rpcss.dll for me, I wish to examine its file version number."  Just doesn't happen much.)  By default, all it searches is essentially the user profiles, thinking that you keep your documents in Documents, pictures in Pictures, music in Music and so on.  Of course, it's probably wrong and you can correct its misguided nature, but it's nice that it's trying only to index the things that you're likely to actually want to search on, not the whole bloody computer.
  • Second, you have very good control of what it can index via both the Control Panel and group policies.  Open up Control Panel and search on "indexing" and the first hit you'll get will be "Indexing Options."  Click that and you'll see a list of the things that Windows Search indexes.  You'll also see a "Modify" button that lets you tell it to index folders that aren't in your profile.  So, for example, if you're like me and keep your digital photos on the E: drive in a folder named Photos rather than in the My Photos folder, you can just tell Windows Search, "don't forget that Photos folder over on E:."  (If you use Windows 7's Libraries, then adding a folder to a library automatically puts it on Windows Search's list of things to index.)  In the group policy editor, just look in Computer / Administrative Templates / Windows Components / Search and you'll see that you have a quite extensive range of control of how Windows Search Service works.  For example, "Default indexed paths" basically lets you centrally control what Windows Search Service looks at.
  • Finally, the scheduler in Vista and later is a lot smarter than the XP scheduler.  So trust me, leave Windows Search on. 

Once you've got your hard drive indexed, you can start using Windows Search quickly.  It'll still work on non-indexed folders, but it won't work as hard -- more on that later --  so I'm going to assume for the rest of this that your files have been indexed.

Advanced Query Language Basics

Here's the good news:  sitting in your Windows Vista or 7 box is a pretty powerful search engine.  Here's the bad news:  it's almost like they didn't want you to use it.  I mean, Explorer isn't perfect, but it's at least a reasonable GUI tool, and so I would have guessed -- call me crazy -- that it would offer a GUI doorway into the powerful desktop search engine.  Explorer doesn't really do that, unfortunately, but it does let you type some cryptic (but short!) bits of text to get that power, so please permit me grab a machete and let's break a path to Search Heaven.

Basically you specify Windows searches with groups of search criteria that look like type:value, like this one:

content:"Jane Eyre"

If you were to open up an Explorer window at the root of C: and type that, your system would attempt to find all files that contain the text string "Jane Eyre," in a case-insensitive manner.  Clearly "content:" means "text inside of a file" in this example, but let's use it as an excuse to look at Search's syntax in a bit more detail.

First, you've got to enter the type of the search criterion with a colon following it.  You do not have to follow the value immediately after the colon -- apparently a space or two's fine, so these would all work:

content:"Jane Eyre"

content: "Jane Eyre"

As you'd probably guess, the double quotes around "Jane Eyre" are essential because there's a space in her name.  If I were merely searching for "Jane," any of these would work, as Windows Search is case-insensitive:

content:Jane

content:"Jane"

content: Jane

content: "Jane"

This would not work, however, at least not if you meant the asterisk to act as a wildcard:

content: "Jan*"

Content searches in Windows Search don't need complete words, so if you want to find every word that starts with "Jan," just type

content: Jan

Another type of search criterion is "title:," which lets you tell Windows to search for all files whose titles match some set of text.  So, for example, to see all files whose title contains "Minasi," I'd type

title:Minasi

(We'll meet criteria other than content: or title: soon, by the way.)  In case you've never given a file a "title," you can usually see a file's title by clicking on the file in Windows Explorer and looking at the bottom pane, like the following figure:

Look at the text to the right of the image and you'll see Date taken, Tags, Rating, Dimensions, Size, and then "Title: How Email Moves."  Another way to see a file's descriptive information is to right-click it in Explorer, choose Properties and then, in the resulting property page, choose the "Details" tab, as you see in the following figure.

You can use this Details page to change most of the properties ("metadata" is the more generic word for these bits of information) that you can see there.  Alternatively, applications associated with file types may let you modify the metadata right in their applications, as Word allows you to change the "title" value for any Word document. 

Note that Explorer and the Details tab's contents will vary considerably from file type to file type.  Things like the Title, Subject, Rating, Tags, Comments, Authors and the like get stored in different places for different file types.  The JPEG standard set aside space to store information like tags (Microsoft's word for "keywords") or comments right in the JPEG file, and so transferring a JPEG file from, say, a Windows system to a Mac or a Linux box would preserve that metadata information.  Office files behave similarly.  Other files store this extra information in NTFS, and have been able to do so since Windows 2000.  In that case, copying a file from an NTFS volume to a FAT32 or other type of volume would cause you to lose its metadata.  Some file types simply lack the ability to carry around metadata in the first place.  Text files are a good example, although even in this case Windows uses alternate data streams to remember when a text file originated on the Internet.  Another reason you'll see files that lack metadata is simply that Microsoft never bothered adding support for the file's built-in metadata abilities, as is the case with PNG (Portable Network Graphics) files -- a look at RFC 2083 will show that PNG files have space for text description strings, but the Details tab and the bottom pane in the Explorer page doesn't offer you the ability to add, change or view those strings.

Finally, if you don't specify a search type at all and just type in some text without colons, as in a case where you type simply "Smith," Windows Search will show you all files that either contain the text "Smith" in them, as if you'd typed "content:Smith," if you'd typed "title:Smith,"or used any of the criteria that we'll soon learn.

Note again that this doesn't happen on non-indexed files.  Instead, when looking to match things like content:, Windows Search looks only at file names for non-indexed files.  You can change that behavior by opening up an Explorer windows, clicking Organize, then Folder and Search Options, and clicking the "Search" tab.  At the top of the page, you'll see a pair of radio buttons that direct Windows Search to either look only at file names for non-indexed files (the default behavior) or instead to "Always search file names and contents (this might take several minutes)."

So, reviewing:

  • Search types let you specify different criteria types for finding files.
  • You enter a search criterion and the value you're looking to match on it as criterion:value, and it's okay to have a space after the colon.
  • If the value you're searching on has a space in it, like "Mark Minasi," surround it with double quotes.
  • Different file types will have space to store different criteria on a Windows box, so for example Windows supports titles for Word documents but not text files or PNGs.
  • If you don't specify a type of criterion (like "title:" or "content:"), then Windows Search will search all possible criteria for whatever text you've typed in.

Searching with AND, OR or NOT

Windows Search supports the logical "and," "or" and "not" operators.  To use them, type them in all caps.  For example, to find all files whose titles include the word "award" and whose text includes "Cary Grant," you could type this in the Search field:

title:award AND content:"Cary Grant"

In truth, however, AND isn't usually necessary, as Windows Search treats multiple criteria as an "AND" request.  For example, this would have the same result as the previous example:

title:award content:"Cary Grant"

OR, however, is necessary.  To see all files that either refer to Cary Grant or whose titles include "award," you'd type

title:award OR content:"Cary Grant"

NOT reverses a criterion, as you'd expect.  To see all files whose titles include the word "award" and that contain "Cary Grant" in their text but not the text "Hepburn," you'd type

title:award AND (content:"Cary Grant" AND NOT content:Hepburn)

As that example shows, you can use parentheses to clarify the search criteria.  Try those out, as it's the AND, OR and NOT that let you create searches like my earlier "find me a PowerPoint created between January 2002 and June 2005 with the word 'watermark' in it," searches that can save you a ton of time.

Search Criteria:  How You Can Search

We've already seen that "content:" lets you search for text inside a file and "title:" lets you search for text in a title, but we've got plenty more criteria that you can use.  Here's a quick look at the ones that you're likely to employ.

Searching on File or Folder Names or Extensions

This is an easy one.  Just use the criteria "file:" or "folder:" to name either.  For example, to find all files with "replication" in their name, use this criterion:

file:replication

In my search example, I'd know that any PowerPoint file built before 2007 would have the extension "ppt," and so to see just those older-format PowerPoints, I might type

file:ppt

But that wouldn't exactly work, as "pptx," the newer PowerPoint format, includes "ppt" in its name.  Time, then, for some AND and NOT:

file:ppt AND (NOT file:pptx)

To be exact, this still isn't right, as it'd find any files with "ppt" anywhere in their name, like "myappts.txt" or something like that.  For that situation, there's even a criterion "ext:" that specializes in extensions, so the final correct query would look like

ext:ppt AND (NOT ext:pptx)

Searching on File Sizes

Use the criterion "size:" to look for file sizes.  Simply type "size:" into the search field and it'll offer you some pre-defined size ranges from "empty," "tiny" (under 10K) up to "gigantic," which Search defines as larger than 128 MB.  (Clearly Search has never seen the files from my audio sets.)  You can specify numbers with the suffixes of k, kb, m, mb, g, gb, t, or tb, and you can use the <, >, =, <= or >= operators.  For example, to see all files larger than 20 megabytes, use this criterion:

size:>20 mb

To see all wmv files larger than 75 MB, type

size:>75MB AND ext:wmv

Searching on Dates

Windows Search gives you four date-related criteria:  datemodfied:, datecreated:, dateaccessed:, or just date:, which refers to any of the three.  It also understands a nice range of ways to represent dates.  For example,

  • "Yesterday," "last week," "a long time ago," "earlier this year," "earlier this week," and "earlier this month" all make sense to Windows Search.
  • "11/18/2011" works fine, as does "December 27, 2006" or "27 December 2006."  Windows Search knows whether "1/2/2010" is 2 January 2010 or 1 February 2010 by looking at your localization settings.
  • You can create ranges of dates by putting two periods between them, as in "datemodified:‎11/‎1/‎2011 .. ‎11/‎30/‎2011"
  • "February" refers to any date in any February of any year.  I can't figure out how to tell it to search just February 2005, short of creating a range.
  • You can use greater-than, equals, less-than etc operators, as in "datemodified:<1/1/2004"

To search for files with the extension .ppt created between January 2002 and June 2005 and that contain the phrase "watermark," then, I'd use this criterion:

ext:ppt AND datecreated:‎1/‎1/‎2002 .. ‎6/‎30/‎2005 AND content:watermark

Searching on Keywords

Windows lets us add keywords to photos, movies and music files.  It calls them "tags."  To find all JPEGs that you've tagged with the phrase "sunset," you'd use this criterion:

tag:sunset

As I'm talking about photos, however, I should point out that by default Windows Explorer has no ability to understand camera raw-format files.  You can fix that, however, by searching on "Microsoft Codec Camera Pack."  The Codec Pack isn't perfect, but it's an improvement over no raw support at all.

That's Just a Start...

Windows Search searches not only files but also emails.  It can use criteria like "aperture:" or "cameramake:" and many others, but it'd make for a long, long newsletter to cover all of that.  I hope this has given you the head start that you need to begin getting more out of Explorer searches.

Upcoming Conferences


  • I will be keynoting the free Tampa IT Pro Camp 2016 on 20 August 2016. Great speakers, sign up now to learn great stuff from some terrific speakers.  https://www.eventbrite.com/e/tampa-it-pro-camp-2016-tickets-24569378673 and tell 'em Mark sent you.
  • I will be presenting at IT/Dev Connections in Vegas the week of 10 October. Http://www.itdevconnections.com/dc16/Public/Enter.aspx for more info.
  • I will also be speaking at the Intersection show also in Vegas the week of 24 October.  Visit https://next.devintersection.com for more info. 
  • December TechMentor is in Orlando this year and I'm keynoting about Server 2016. https://techmentorevents.com/Home.aspx for all the scoop!
I hope to see some of you at one of these shows!

To Subscribe/Unsubscribe, Read Old Newsletters or Change Your Email Address

To subscribe, visit http://www.minasi.com/nwsreg.htm. To change e-mail or other info, link to http://www.minasi.com/edit-newsletter-record.htm.  To unsubscribe, link to http://www.minasi.com/unsubs.htm. Visit the Archives at http://www.minasi.com/archive.htm. Please do not reply to this mail; for comments, please link to http://www.minasi.com/gethelp.

All contents copyright 2011 Mark Minasi.  I encourage you to quote this material, SO LONG as you include this entire document; thanks.