---
title: "Tips: What are best practices for scanning large (Exchange) mailboxes?"
url: "https://dm0bkdes5q7a2ls.productfruits.help/en/article/54ad5640-d24b-4387-bf4e-1b92053ef220"
language: "en"
last_updated: "2026-05-06T15:20:03.362Z"
---

# Tips: What are best practices for scanning large (Exchange) mailboxes?

Scanning large mailboxes (50 GB+) requires a strategic approach to prevent the Spirion Agent from impacting user productivity or overwhelming the Exchange infrastructure.

Here are the established best practices for managing large-scale email scans:

## 1\. Prioritize "Cached Mode" for Routine Scans

For standard, recurring scans, always set **"Search only Cached Exchange Stores"** to **Yes**.

-   **Why:** This limits the scan to the data already on the user's hard drive. It eliminates network latency and prevents the "Outlook is retrieving data" hang that frustrates users.
-   **Trade-off:** You may miss older data not synced to the local machine, but you gain significant stability and speed.

## 2\. Use "Discovery-Only" Scans to Identify Hotspots

Before running a full sensitive data scan on thousands of large mailboxes, run a **Discovery Scan** ("Data Types" unchecked).

-   **Why:** This enables you to see which mailboxes are the largest and which folders contain the most items without the overhead of deep content analysis.
-   **Action:** Use the results to identify "problem" mailboxes that might need to be moved to a dedicated, off-hours scan group.

## 3\. Leverage Folder GUIDs for Targeted Scanning

If you know that sensitive data is likely stored in specific areas (for example, "Finance" or "HR" folders), use the **"Search Selected Outlook Folders"** option with GUIDs.

-   **Why:** Instead of scanning a 100 GB mailbox, the Agent can jump directly to the 2 GB folder that actually matters. This reduces scan time from hours to minutes.

## 4\. Exclude "Noise" Folders

Large mailboxes are often inflated by folders that rarely contain actionable sensitive data. Use the **Exclude** options in the wizard for:

-   **Deleted Items / Dumpster:** Unless required for legal reasons, excluding these can significantly reduce the item count.
-   **Junk Email:** High volume, low value.
-   **RSS Feeds / Sync Issues:** These folders often contain thousands of small system messages that slow down the MAPI crawler.

## 5\. Manage Attachment Scanning

Attachments are the primary cause of "slow" email scans.

-   **Limit by Size:** Configure the policy to skip attachments larger than a certain size (for example, 20 MB). Large attachments often contain video or encrypted installers that Spirion cannot scan anyway.
-   **Limit by Type:** Exclude known "safe" or "unscannable" extensions (for example, `.exe`, `.zip`, `.mp4`) to keep the agent focused on documents and spreadsheets.

## 6\. Throttle the Scan (CPU and Network)

For large mailboxes, the Agent is active for a longer duration.

-   **CPU Throttling:** Set the agent to "Low" or "Below Normal" priority in the policy settings. This ensures that even if the scan takes a long time, the user can still use Word, Excel, and Outlook without lag.
-   **Staggered Start:** Do not start scans for 5,000 users at the same time. Use the **"Random Delay"** feature in the Spirion Console to spread the start times over several hours.

## 7\. Handle "Online Archives" Separately

If your organization uses **Exchange Online Archives**, do not include them in the same policy as the primary mailbox scan.

-   **Why:** Archives are almost always "Online Only." Scanning them requires setting "Search only Cached Exchange Stores" to **No**, which is slow.
-   **Best Practice:** Create a separate, quarterly policy specifically for Archives and run it during low-traffic periods (for example, weekends).

## 8\. Monitor for "MAPI\_E\_TABLE\_TOO\_BIG"

In extremely large folders (for example, an Inbox with 100,000+ items), the MAPI subsystem itself may fail.

-   **The Fix:** If you see this error in the logs, the user must be instructed to archive their data into sub-folders. Spirion (and Outlook) performs much better with 10 folders of 10,000 items than 1 folder of 100,000 items.

## Summary

For large mailboxes, **speed is achieved through exclusion**. By focusing on **Cached data**, using **GUIDs** for targeting, and **excluding high-volume/low-value folders**, you can maintain a strong security posture without disrupting the business.