Resolve common eDiscovery bug

  • Commodity
  • 10 minutes to read

This commodity covers bones troubleshooting steps that you can take to identify and resolve bug that y'all might come across during an eDiscovery search or elsewhere in the eDiscovery process. Resolving some of these scenarios requires help from Microsoft Support. Data about when to contact Microsoft Support is included in the resolution steps.

Fault/issue: Ambiguous location

If you endeavour to add a user's mailbox location to a search, and there are duplicate or conflicting objects that take the same userID in the Commutation Online Protection (EOP) directory, you receive this error bulletin:

The compliance search contains the following invalid location(s): useralias@contoso.com. The location useralias@contoso.com is ambiguous.

Resolution

Check for duplicate users or distribution lists that take the same user ID.

  1. Connect to Security & Compliance Center PowerShell.

  2. Run the following command to retrieve all instances of the username:

                      Get-Recipient <username>

    The output for "useralias@contoso.com" will resemble the following:

    Name RecipientType
    Alias, User MailUser
    Allonym, User User

  3. If multiple users are returned, locate and fix the conflicting object.

Fault/result: Search fails on specific locations

An eDiscovery or content search might yield the following error:

This search completed with (#) errors. Would you lot like to retry the search on the failed locations?

Screenshot of search-specific location fails error.

Resolution

If yous receive this message, we recommend that you verify the locations that failed in the search, and then rerun the search on the failed locations merely.

  1. Connect to Security & Compliance Center PowerShell and then run the following command:

                      Get-ComplianceSearch <searchname> | FL

  2. From the PowerShell output, view the failed locations in the errors field or from the condition details in the error message from the search output.

  3. Retry the eDiscovery search on the failed locations merely.

  4. If you continue to receive these errors, see Retry failed locations for more troubleshooting steps.

Error/consequence: File not found

When running an eDiscovery search that includes SharePoint Online and OneDrive for Business locations, yous might receive a "File Non Constitute" fault message although the file is located on the site. This message will be posted in the consign warnings and errors.csv or skipped items.csv. This might occur if the file tin't be constitute on the site or if the alphabetize is out-of-date. Here's the text of an actual fault message (with emphasis added):

28.06.2019 10:02:19_FailedToExportItem_Failed to download content. Additional diagnostic info : Microsoft.Office.Compliance.EDiscovery.ExportWorker.Exceptions.ContentDownloadTemporaryFailure: Failed to download from content 6ea52149-xyxy-xyxy-b5bb-82ca6a3ec9be of type Document. Correlation Id: 3bd84722-xyxy-xyxy-b61b-08d6fba9ec32. ServerErrorCode: -2147024894 ---> Microsoft.SharePoint.Client.ServerException: File Not Institute . at Microsoft.SharePoint.Client.ClientRequest.ProcessResponseStream(Stream responseStream) at Microsoft.SharePoint.Client.ClientRequest.ProcessResponse() --- Stop of inner exception stack trace ---

Resolution

  1. Cheque the location that's identified in the search to make sure that the location of the file is correct and added in the search locations.

  2. To reindex the site, use the procedures that er provided in Manually request crawling and reindexing of a site, a library, or a list.

Error/issue: This file wasn't exported considering information technology doesn't exist anymore. The file was included in the count of estimated search results because it's still listed in the alphabetize. The file will eventually be removed from the index, and won't cause an error in the future

You might see that fault when running an eDiscovery search that includes SharePoint Online and OneDrive for Business locations. eDiscovery relies on the SPO index to identify the file locations. If the file was deleted merely the SPO index was not yet updated this error might occur.

Resolution

Open the SPO location, and verify that this file is, indeed, not there. The suggested solution is to manually reindex the site, or wait until the site reindexes through the automatic background process.

Effect: This search result was not downloaded as it is a folder or other artifact that tin can't be downloaded by itself, whatsoever items inside the folder or library will exist downloaded

You might meet this error message when you run an eDiscovery search that includes SharePoint Online and OneDrive for Business locations. Information technology means that we were going to endeavor to consign the item that'due south reported in the alphabetize, simply the item turned out to be a folder. Therefore, we did not export information technology. As mentioned in the mistake bulletin, we don't export folders, but nosotros do consign their contents.

Error/effect: Search fails considering recipient is not establish

An eDiscovery search fails and returns a "recipient not found" error bulletin. This error might occur if the user object cannot be found in Commutation Online Protection (EOP) because the object has non synced.

Resolution

  1. Connect to Substitution Online PowerShell.

  2. Run the following control to cheque whether the user is synced to Commutation Online Protection:

                      Go-Recipient <userId> | FL

  3. In that location should exist a mail service user object for the user question. If zip is returned, investigate the user object. Contact Microsoft Support if the object can't be synced.

Error/issue: Search fails with error CS007

When performing a Content search or a search associated with a Core eDiscovery case, a transient error occurs and the search fails with a CS007 error.

Resolution

  1. Update the search and reduce the complexity of the search query. For example, a wildcard search might return too many results for the system to procedure, which causes a CS007 mistake.

  2. Rerun the updated search.

Error/consequence: Exporting search results is slow

When exporting search results from Core eDiscovery or Content search in the Microsoft 365 compliance eye, the download takes longer than expected. You can check to run into the corporeality of information to be download and possibly increment the consign speed.

Resolution

  1. Connect to Security & Compliance Center PowerShell, and then run the following command:

                      Get-ComplianceSearch <searchname> | FL

  2. Find the amount of information that's to be downloaded in the SearchResults and SearchStatistics parameters.

  3. Run the following control:

                      Get-ComplianceSearchAction | FL

  4. In the results field, find the information that has been exported, and and so view any errors that were encountered.

  5. Check for any errors in the Trace.log file located in the directory that y'all exported the content to.

  6. If you lot still take issues, consider dividing searches that return a big set up of results into smaller searches. For example, you can utilize engagement ranges in search queries to render a smaller set of results that can exist downloaded faster.

Fault/outcome: Consign process not progressing or is stuck

When you export search results from Core eDiscovery or Content search in the Microsoft 365 compliance middle, the consign process is not progressing or appears to exist stuck.

Resolution

  1. If necessary, rerun the search. If the search concluding ran more than vii days ago, yous have to rerun the search.

  2. Restart the consign.

Error/result: "Internal server fault (500) occurred"

When you lot run an eDiscovery search, if the search continually fails and returns an fault message that resembles "Internal server error (500) occurred," you lot might have to rerun the search on specific mailbox locations only.

(500) Internal Server Error.

Screenshot of Internal server error (500).

Resolution

  1. Pause the search into smaller searches, and run the search once again. Attempt using a smaller date range or limit the number of locations that are searched.

  2. Connect to Security & Compliance Center PowerShell, and then run the following command:

                      Get-ComplianceSearch <searchname> | FL

  3. Examine the output for results and errors.

  4. Examine the Trace.log file in the same binder that you lot exported the search results to.

  5. Contact Microsoft Support.

Fault/issue: Holds don't sync

eDiscovery Instance Hold Policy Sync Distribution fault. The mistake reads:

"Resource: Information technology's taking longer than expected to deploy the policy. It might have an additional ii hours to update the concluding deployment status, then check dorsum in a couple hours."

Resolution

  1. Connect to Security & Compliance Centre PowerShell so run the following command for an eDiscovery case concord:

                      Get-CaseHoldPolicy <policyname> - DistributionDetail | FL

    For a retention policy, run the following control:

                      Get-RetentionCompliancePolicy <policyname> - DistributionDetail | FL

  2. Examine the value in the DistributionDetail parameter for errors similar the post-obit:

    Fault: Resources: Information technology's taking longer than expected to deploy the policy. It might take an additional 2 hours to update the final deployment status, then check back in a couple hours."

  3. Effort running the RetryDistribution parameter on the policy in question:

    For eDiscovery example holds:

                      Set-CaseHoldPolicy <policyname> -RetryDistribution

    For retention policies:

                      Set-RetentionCompliancePolicy <policyname> -RetryDistribution

  4. Contact Microsoft Support.

Error/issue: Holds stuck in PendingDeletion

eDiscovery Case Hold Policies may be stuck in PendingDeletion and can't be removed.

Resolution

  1. Connect to Security & Compliance Center PowerShell.

  2. Try running the RetryDistribution parameter on the policy in question:

    For eDiscovery case holds:

                      Set-CaseHoldPolicy <policyname> -RetryDistribution

    For retention policies:

                      Set-RetentionCompliancePolicy <policyname> -RetryDistribution

  3. Endeavour to delete the policy using PowerShell and the -ForceDeletion parameter:

    For eDiscovery case holds, use the Remove-CaseHoldPolicy cmdlet:

                      Remove-CaseHoldPolicy <policyname> -ForceDeletion

    For retention policies, apply the Remove-RetentionCompliancePolicy cmdlet:

                      Remove-RetentionCompliancePolicy <policyname> -ForceDeletion

  4. Contact Microsoft Support.

Error/upshot: "The condition specified using HTTP conditional header(south) is not met"

When downloading search results using the eDiscovery Export Tool, yous might receive the following mistake message:

Organisation.Internet.WebException: The remote server returned an error: (412) The status specified using HTTP conditional header(s) is not met.

This is a transient error that typically occurs in the Azure Storage location.

Resolution

To resolve this effect, retry downloading the search results. This will restart the eDiscovery Export Tool.

Error/issue: Downloaded export shows no results

Later on a successful export, the completed download through the export tool shows aught files in the results.

Resolution

This is a customer-side consequence. To remediate information technology, follow these steps:

  1. Try using another client to download.

  2. Remove old searches that are no longer required. To do this, run the Remove-ComplianceSearch cmdlet.

  3. Brand certain to download to a local bulldoze.

  4. Make certain that the virus scanner is not running.

  5. Make sure that no other export is downloading to the aforementioned folder or any parent folder.

  6. If the previous steps don't work, disable zipping and de-duplication.

  7. If step vii works, then the issue occurs because of a local virus scanner or a disk issue.

Error: "Your asking tin can't be started because the maximum number of jobs for your organisation are currently running"

Your organization has reached the limit for the maximum number of concurrent consign jobs. All new consign jobs are being throttled.

Resolution

To discover how many export jobs that were started in the concluding seven days are nevertheless running, follow these steps:

  1. Connect to Security & Compliance Center PowerShell.

  2. To collect information most the current export jobs that are triggering the throttle, run the following cmdlets as an eDiscovery ambassador.

    Notation: An eDiscovery ambassador is a fellow member of the eDiscovery Managing director part grouping, and tin view all eDiscovery cases. You can use the Become-eDiscoveryCaseAdmin cmdlet to check for eDiscovery administrators, and use the Add-eDiscoveryCaseAdmin cmdlet to add an eDiscovery administrator. The cmdlets might take some time to finish, depending on the number of cases.

                      $date = Get-Date $Exports = @(Get-ComplianceSearchAction -export -ResultSize Unlimited) $cases = Go-ComplianceCase | ?{$_.condition -like "Active"}  $i = ane foreach ($example in $cases) { $Exports += Get-ComplianceSearchAction -consign -case $case.proper name write-host "Processing example $($i) of $($cases.count)" $i++ }  $inprogressExports = $exports | ?{$_.Results -eq $null -or (!$_.Results.Contains("Consign status: Completed") -and !$_.Results.Contains("Export status: none"))}; $exportJobsRunning = $inprogressExports | ?{$_.JobStartTime -ge $date.AddDays(-7)} | Sort-Object JobStartTime -Descending

  3. Run the post-obit cmdlet to display a listing of export jobs that are currently running.

    Note: If the cmdlet returns 10 or more exports jobs, your arrangement has reached the limit for the number of concurrent consign jobs. For more data, see Limits for eDiscovery search.

                      $exportJobsRunning | Format-Table Name, JobStartTime, JobEndTime, Condition | More than;

  4. Wait for existing export jobs to finish, or use the Remove-ComplianceSearchAction cmdlet to remove consign jobs that are no longer required.

Fault: "Hitting tolerable error, will retry: The process cannot access the file 'ExportData.db' considering it is being used by another process."

The consign procedure may get stuck, or produce zero-byte files.

Resolution

This can be a client-side issue. To remediate it, follow these steps:

  1. Try using another client to download.

  2. Remove erstwhile searches that are no longer required by running the Remove-ComplianceSearch cmdlet.

  3. Make certain to download to a local bulldoze.

  4. Make sure that the virus scanner isn't running.

  5. Brand sure that no other export is downloading to the aforementioned folder or any parent folder.

  6. If the previous steps don't work, disable zipping and de-duplication.

  7. If step 6 works, then the issue occurs because of a local virus scanner or a deejay issue.

If none of these steps solve the trouble, gather the output of Get-ComplianceSearch and Get-ComplianceSearchAction before creating a back up case.