Resolve mutual eDiscovery problems

  • Article
  • 10 minutes to read

Notation

Microsoft 365 compliance is now chosen Microsoft Purview and the solutions within the compliance surface area have been rebranded. For more information almost Microsoft Purview, see the blog announcement.

This article covers basic troubleshooting steps that you can accept to identify and resolve bug that yous might encounter during an eDiscovery search or elsewhere in the eDiscovery process. Resolving some of these scenarios requires assistance from Microsoft Support. Information nearly when to contact Microsoft Support is included in the resolution steps.

Error/issue: Cryptic location

If you effort to add together a user's mailbox location to a search, and in that location are duplicate or alien objects that accept the same userID in the Exchange Online Protection (EOP) directory, you receive this mistake message:

The compliance search contains the following invalid location(s): useralias@contoso.com. The location useralias@contoso.com is ambiguous.

Resolution

Bank check for duplicate users or distribution lists that take the aforementioned user ID.

  1. Connect to Security & Compliance Heart PowerShell.

  2. Run the following control to retrieve all instances of the username:

                      Get-Recipient <username>

    The output for "useralias@contoso.com" volition resemble the post-obit:

    Name RecipientType
    Alias, User MailUser
    Alias, User User

  3. If multiple users are returned, locate and fix the conflicting object.

Error/result: Search fails on specific locations

An eDiscovery or content search might yield the following error:

This search completed with (#) errors. Would you like to retry the search on the failed locations?

Screenshot of search-specific location fails error.

Resolution

If y'all receive this message, we recommend that you lot verify the locations that failed in the search, and then rerun the search on the failed locations but.

  1. Connect to Security & Compliance Center PowerShell and then run the following command:

                      Get-ComplianceSearch <searchname> | FL

  2. From the PowerShell output, view the failed locations in the errors field or from the status details in the error message from the search output.

  3. Retry the eDiscovery search on the failed locations merely.

  4. If you go along to receive these errors, meet Retry failed locations for more than troubleshooting steps.

Error/effect: File not found

When running an eDiscovery search that includes SharePoint Online and OneDrive for Business organisation locations, you might receive a "File Not Found" error message although the file is located on the site. This message will exist posted in the consign warnings and errors.csv or skipped items.csv. This might occur if the file can't be plant on the site or if the index is out-of-date. Here's the text of an actual fault message (with emphasis added):

28.06.2019 ten:02:19_FailedToExportItem_Failed to download content. Boosted diagnostic info : Microsoft.Role.Compliance.EDiscovery.ExportWorker.Exceptions.ContentDownloadTemporaryFailure: Failed to download from content 6ea52149-xyxy-xyxy-b5bb-82ca6a3ec9be of type Document. Correlation Id: 3bd84722-xyxy-xyxy-b61b-08d6fba9ec32. ServerErrorCode: -2147024894 ---> Microsoft.SharePoint.Client.ServerException: File Not Found . at Microsoft.SharePoint.Customer.ClientRequest.ProcessResponseStream(Stream responseStream) at Microsoft.SharePoint.Client.ClientRequest.ProcessResponse() --- End of inner exception stack trace ---

Resolution

  1. Check the location that'southward identified in the search to make certain that the location of the file is correct and added in the search locations.

  2. To reindex the site, utilise the procedures that er provided in Manually request crawling and reindexing of a site, a library, or a listing.

Error/issue: This file wasn't exported considering it doesn't exist anymore. The file was included in the count of estimated search results because information technology's still listed in the index. The file will eventually exist removed from the index, and won't cause an mistake in the future

You might see that error when running an eDiscovery search that includes SharePoint Online and OneDrive for Business locations. eDiscovery relies on the SPO index to identify the file locations. If the file was deleted but the SPO alphabetize was non yet updated this error might occur.

Resolution

Open the SPO location, and verify that this file is, indeed, non there. The suggested solution is to manually reindex the site, or wait until the site reindexes through the automatic background process.

Issue: This search result was not downloaded as information technology is a binder or other antiquity that tin't be downloaded by itself, any items inside the binder or library volition be downloaded

You might see this error message when you run an eDiscovery search that includes SharePoint Online and OneDrive for Business locations. It means that we were going to try to export the particular that's reported in the alphabetize, but the particular turned out to be a folder. Therefore, we did not export information technology. As mentioned in the error message, we don't export folders, but we do consign their contents.

Fault/upshot: Search fails because recipient is not found

An eDiscovery search fails and returns a "recipient not constitute" mistake message. This mistake might occur if the user object cannot be found in Exchange Online Protection (EOP) because the object has not synced.

Resolution

  1. Connect to Substitution Online PowerShell.

  2. Run the post-obit control to bank check whether the user is synced to Exchange Online Protection:

                      Get-Recipient <userId> | FL

  3. At that place should be a mail service user object for the user question. If nothing is returned, investigate the user object. Contact Microsoft Back up if the object can't be synced.

Mistake/issue: Search fails with error CS007

When performing a Content search or a search associated with a eDiscovery (Standard) instance, a transient mistake occurs and the search fails with a CS007 mistake.

Resolution

  1. Update the search and reduce the complexity of the search query. For example, a wildcard search might return too many results for the organisation to process, which causes a CS007 error.

  2. Rerun the updated search.

Error/event: Exporting search results is tiresome

When exporting search results from eDiscovery (Standard) or Content search in the Microsoft Purview compliance portal, the download takes longer than expected. You tin can cheque to see the amount of data to be download and possibly increment the consign speed.

Resolution

  1. Connect to Security & Compliance Centre PowerShell, and then run the post-obit command:

                      Get-ComplianceSearch <searchname> | FL

  2. Detect the amount of information that's to exist downloaded in the SearchResults and SearchStatistics parameters.

  3. Run the following command:

                      Go-ComplianceSearchAction | FL

  4. In the results field, observe the data that has been exported, and then view any errors that were encountered.

  5. Bank check for whatsoever errors in the Trace.log file located in the directory that you exported the content to.

  6. If you all the same have bug, consider dividing searches that return a large prepare of results into smaller searches. For case, you can utilize date ranges in search queries to return a smaller prepare of results that tin be downloaded faster.

Error/issue: Export process not progressing or is stuck

When you lot consign search results from eDiscovery (Standard) or Content search in the Microsoft Purview compliance portal, the consign procedure is not progressing or appears to be stuck.

Resolution

  1. If necessary, rerun the search. If the search final ran more than than seven days ago, you take to rerun the search.

  2. Restart the export.

Error/event: "Internal server error (500) occurred"

When yous run an eDiscovery search, if the search continually fails and returns an fault bulletin that resembles "Internal server error (500) occurred," you lot might have to rerun the search on specific mailbox locations only.

(500) Internal Server Fault.

Screenshot of Internal server error (500).

Resolution

  1. Intermission the search into smaller searches, and run the search once more. Endeavour using a smaller appointment range or limit the number of locations that are searched.

  2. Connect to Security & Compliance Center PowerShell, and then run the following command:

                      Become-ComplianceSearch <searchname> | FL

  3. Examine the output for results and errors.

  4. Examine the Trace.log file in the same folder that y'all exported the search results to.

  5. Contact Microsoft Support.

Fault/issue: Holds don't sync

eDiscovery Instance Hold Policy Sync Distribution fault. The error reads:

"Resource: Information technology'southward taking longer than expected to deploy the policy. Information technology might take an additional ii hours to update the final deployment status, so check dorsum in a couple hours."

Resolution

  1. Connect to Security & Compliance Eye PowerShell and so run the following command for an eDiscovery case concord:

                      Get-CaseHoldPolicy <policyname> - DistributionDetail | FL

    For a retention policy, run the following control:

                      Get-RetentionCompliancePolicy <policyname> - DistributionDetail | FL

  2. Examine the value in the DistributionDetail parameter for errors like the post-obit:

    Error: Resource: It's taking longer than expected to deploy the policy. It might have an additional 2 hours to update the terminal deployment condition, and then cheque back in a couple hours."

  3. Attempt running the RetryDistribution parameter on the policy in question:

    For eDiscovery case holds:

                      Gear up-CaseHoldPolicy <policyname> -RetryDistribution

    For retentivity policies:

                      Gear up-RetentionCompliancePolicy <policyname> -RetryDistribution

  4. Contact Microsoft Back up.

Error/outcome: Holds stuck in PendingDeletion

eDiscovery Case Hold Policies may be stuck in PendingDeletion and can't be removed.

Resolution

  1. Connect to Security & Compliance Center PowerShell.

  2. Endeavor running the RetryDistribution parameter on the policy in question:

    For eDiscovery case holds:

                      Set-CaseHoldPolicy <policyname> -RetryDistribution

    For retention policies:

                      Prepare-RetentionCompliancePolicy <policyname> -RetryDistribution

  3. Try to delete the policy using PowerShell and the -ForceDeletion parameter:

    For eDiscovery case holds, use the Remove-CaseHoldPolicy cmdlet:

                      Remove-CaseHoldPolicy <policyname> -ForceDeletion

    For retention policies, apply the Remove-RetentionCompliancePolicy cmdlet:

                      Remove-RetentionCompliancePolicy <policyname> -ForceDeletion

  4. Contact Microsoft Back up.

Error/result: "The status specified using HTTP conditional header(s) is not met"

When downloading search results using the eDiscovery Consign Tool, yous might receive the following error message:

System.Net.WebException: The remote server returned an mistake: (412) The condition specified using HTTP conditional header(s) is not met.

This is a transient error that typically occurs in the Azure Storage location.

Resolution

To resolve this issue, retry downloading the search results. This will restart the eDiscovery Export Tool.

Error/event: Downloaded export shows no results

After a successful export, the completed download through the export tool shows zero files in the results.

Resolution

This is a client-side issue. To remediate it, follow these steps:

  1. Attempt using another client to download.

  2. Remove old searches that are no longer required. To exercise this, run the Remove-ComplianceSearch cmdlet.

  3. Make sure to download to a local drive.

  4. Make certain that the virus scanner is non running.

  5. Make certain that no other export is downloading to the same folder or any parent folder.

  6. If the previous steps don't piece of work, disable zipping and de-duplication.

  7. If step 7 works, then the issue occurs considering of a local virus scanner or a disk upshot.

Mistake: "Your request tin't exist started because the maximum number of jobs for your organization are currently running"

Your organization has reached the limit for the maximum number of concurrent export jobs. All new export jobs are being throttled.

Resolution

To discover how many export jobs that were started in the last seven days are still running, follow these steps:

  1. Connect to Security & Compliance Center PowerShell.

  2. To collect information nigh the current export jobs that are triggering the throttle, run the following cmdlets equally an eDiscovery ambassador.

    Note: An eDiscovery ambassador is a member of the eDiscovery Manager role group, and can view all eDiscovery cases. You can utilise the Get-eDiscoveryCaseAdmin cmdlet to check for eDiscovery administrators, and use the Add together-eDiscoveryCaseAdmin cmdlet to add an eDiscovery administrator. The cmdlets might take some time to finish, depending on the number of cases.

                      $date = Get-Date $Exports = @(Get-ComplianceSearchAction -export -ResultSize Unlimited) $cases = Get-ComplianceCase | ?{$_.status -like "Active"}  $i = 1 foreach ($case in $cases) { $Exports += Get-ComplianceSearchAction -export -case $case.name write-host "Processing case $($i) of $($cases.count)" $i++ }  $inprogressExports = $exports | ?{$_.Results -eq $null -or (!$_.Results.Contains("Consign status: Completed") -and !$_.Results.Contains("Export status: none"))}; $exportJobsRunning = $inprogressExports | ?{$_.JobStartTime -ge $engagement.AddDays(-7)} | Sort-Object JobStartTime -Descending

  3. Run the post-obit cmdlet to display a list of export jobs that are currently running.

    Annotation: If the cmdlet returns 10 or more exports jobs, your system has reached the limit for the number of concurrent export jobs. For more information, see Limits for eDiscovery search.

                      $exportJobsRunning | Format-Table Name, JobStartTime, JobEndTime, Status | More;

  4. Wait for existing export jobs to terminate, or utilize the Remove-ComplianceSearchAction cmdlet to remove consign jobs that are no longer required.

Error: "Hit tolerable error, will retry: The procedure cannot access the file 'ExportData.db' because it is being used by another process."

The export process may get stuck, or produce cypher-byte files.

Resolution

This can be a customer-side issue. To remediate it, follow these steps:

  1. Attempt using another customer to download.

  2. Remove old searches that are no longer required by running the Remove-ComplianceSearch cmdlet.

  3. Make sure to download to a local drive.

  4. Make sure that the virus scanner isn't running.

  5. Make sure that no other export is downloading to the same binder or whatever parent folder.

  6. If the previous steps don't work, disable zipping and de-duplication.

  7. If step 6 works, so the issue occurs considering of a local virus scanner or a disk issue.

If none of these steps solve the problem, assemble the output of Get-ComplianceSearch and Go-ComplianceSearchAction before creating a support example.